Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Phishing Campaign Deploys JavaScript-Driven PureLogs Variant to Steal Sensitive Data
SOC Prime Bias: Medium
Fortinet Blog
Fake software on GitHub and SourceForge distribute Deno RAT by Gabriele Orini
SOC Prime Bias: Critical
Malwarebytes
From edge appliance to enterprise compromise: Multi-stage Linux intrusion via F5 and Confluence
SOC Prime Bias: Critical
Microsoft Security Blog
Claude Impersonation Page May Deliver ACR Stealer
SOC Prime Bias: Medium
SANS Internet Storm Center
Void Dokkaebi Uses Cython-Compiled InvisibleFerret Malware
SOC Prime Bias: Critical
Trend Micro
Payload Ransomware: In-Depth Technical Analysis
SOC Prime Bias: High
Darkatlas
DeepLoad Malware Explained: ClickFix Delivery and Credential Theft
SOC Prime Bias: Medium
picussecurity.com
SEO Poisoning Campaign Uses Gemini and Claude Code Lures to Deliver an Infostealer
SOC Prime Bias: Medium
EclecticIQ
NightSpire Ransomware Attack Chain, Tools and Tactics
SOC Prime Bias: High
picussecurity.com
UAC-0057 Updates Its Toolkit with OYSTERFRESH, OYSTERSHUCK, and OYSTERBLUES
SOC Prime Bias: Medium
cert.gov.ua