Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
STX RAT Supply Chain Attack Hits Wallets and X-VPN
SOC Prime Bias: Critical
Sekoia.io Blog
From Crypto Wallets to a 100M-User VPN: Inside an Active STX RAT Supply Chain Campaign
SOC Prime Bias: Critical
cyderes.com
Seeking Counsel: Ongoing Targeted Attacks Against US Law Firms
SOC Prime Bias: High
Google Cloud Blog
AI-Powered Roblox Cheats Deliver the Yuta/Solara Stealer
SOC Prime Bias: Medium
Derp
PulseRAT Delivered Through a UAE-India Partnership Lure
SOC Prime Bias: Critical
dmpdump
Preinstall to Persistence: Inside the Red Hat npm Miasma Credential-Theft Campaign
SOC Prime Bias: Critical
Microsoft Security Blog
GammaSteel: Inside Gamaredon’s Unfolding Malware Chain
SOC Prime Bias: Critical
Sekoia.io Blog
The Evil MSI Background Returns
SOC Prime Bias: Medium
SANS Internet Storm Center
Miasma Supply Chain Attack Spreads Through the Phantom Gyp Worm
SOC Prime Bias: Critical
stepsecurity.io
C0XMO: A New Gafgyt Variant with Cross-Platform Propagation
SOC Prime Bias: Critical
Fortinet Blog