Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Operation XENOFISCAL: SideCopy Deploys Persistent XenoRAT Against Afghanistan’s Ministry of Finance
SOC Prime Bias: Critical
Seqrite Labs
No Malware, No Alerts, Just a USB Drive in Your Office
SOC Prime Bias: Critical
Andrea Fortuna
FortiClient EMS Exploited via CVE-2026-35616 to Deliver EKZ Infostealer Disguised as a Fortinet Patch
SOC Prime Bias: Critical
Arctic Wolf
Crypto Software Development Infrastructure Targeted by a New Threat Actor
SOC Prime Bias: Critical
wiz.io
RVTools Masquerade: How a Signed Fake Installer Deploys a Modular Python RAT
SOC Prime Bias: Medium
K7 Labs
Tracing an Akira Ransomware Kill Chain Through Perimeter and Endpoint Logs
SOC Prime Bias: High
SANS Internet Storm Center
700+ education and tech websites hijacked in huge ClickFix malware campaign
SOC Prime Bias: Critical
Malwarebytes
Fake “Secure Mail” Lures Deliver Malicious Files Posing as Credit Card Firms
SOC Prime Bias: Medium
ASEC
BlackToad Uses Network Manipulation in an AutoIt Payload
SOC Prime Bias: Medium
JUMPSEC
From Poisoned Search Results to GPU Mining: A Cryptojacking Campaign Using ScreenConnect and .NET Utilities
SOC Prime Bias: Medium
Microsoft Security Blog