Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
ErrTraffic v3 Uses EtherHiding in ClickFix Campaigns
SOC Prime Bias: Medium
levelbluecyber
UAC-0247 Targets Hospitals, Local Governments, and FPV Operators
SOC Prime Bias: Critical
cert.gov.ua
Dragon Boss Leaves 25,000+ Endpoints Exposed
SOC Prime Bias: Critical
Huntress
JanaWare Ransomware Targets Turkey via Adwind RAT
SOC Prime Bias: High
Acronis
Fake Claude site installs malware that gives attackers access to your computer
SOC Prime Bias: Medium
Malwarebytes
Obfuscated JavaScript at the Core of the Attack
SOC Prime Bias: Medium
SANS Internet Storm Center
Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT
SOC Prime Bias: Medium
elastic.co
VIPERTUNNEL Python Backdoor: A Deep Dive
SOC Prime Bias: High
InfoGuard Labs
In-Memory Loader Drops ScreenConnect
SOC Prime Bias: Medium
Multiple Vulnerabilities Found In ConnectWise ScreenConnect Read post
Silver Fox Wraps ValleyRAT in ZPAQ and a ByteDance Binary: A Telegram Chinese Language Pack MSI Lure
SOC Prime Bias: Critical
Breakglass Intelligence