Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
UNC1549 TTPs: Iranian APT Targeting Aerospace and Defense
SOC Prime Bias: Critical
picussecurity.com
ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
SOC Prime Bias: Critical
Google Cloud Blog
Interlock and Rhysida: AI in the Ransomware Ecosystem
SOC Prime Bias: Critical
ibm.com
OnyxC2: A New Stealer Targeting 210 Applications
SOC Prime Bias: High
BlackFog
Analyzing SHEET#CREEP: The Malware Returns with New Config Obfuscation
SOC Prime Bias: Critical
Securonix
CVE-2026-35273: Oracle PeopleSoft Zero-Day Exploited in the Wild
SOC Prime Bias: Critical
Rapid7
Tengu Ransomware: From Initial Access to Encryption
SOC Prime Bias: High
picussecurity.com
From Fiscal Lures to NinjaOne RMM Abuse
SOC Prime Bias: High
Cato Networks
[Op Report] From SSA Phish to AdaptixC2: A Multi-RAT Intrusion
SOC Prime Bias: High
Deception.Pro Blog
Solana FakeFix: 25 Malicious npm and PyPI Packages Pose as Stable Builds
SOC Prime Bias: Critical
JFrog Security Research