Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Abusing Legitimate Low-Level Tools to Help Ransomware Evade Antivirus Detection
SOC Prime Bias: High
Seqrite
T1547.008 LSASS Driver in MITRE ATT&CK Explained
SOC Prime Bias: Critical
picussecurity.com
Cyberattack UAC-0255 disguised as a notification from CERT-UA using the AGEWHEEZE tool
SOC Prime Bias: Medium
cert.gov.ua
Infiniti Stealer: a new macOS infostealer using ClickFix and Python/Nuitka
SOC Prime Bias: Medium
Malwarebytes
Say My Name: How MioLab is building MacOS Stealer Empire
SOC Prime Bias: Medium
levelbluecyber
InterLock: Full Tooling Breakdown of a Ransomware Operation
SOC Prime Bias: High
Derp
Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities
SOC Prime Bias: Critical
Trend Micro
Case Study: How Defender’s Predictive Shielding Blocked GPO-Based Ransomware Before Execution
SOC Prime Bias: High
Microsoft Security Blog
SmartApeSG campaign pushes Remcos RAT, NetSupport RAT, StealC, and Sectop RAT (ArechClient2)
SOC Prime Bias: Medium
SANS Internet Storm Center
Malware Attack Targeting MS‑SQL Servers to Deploy the ICE Cloud Scanner (Larva-26002)
SOC Prime Bias: High
ASEC