Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
From PDB Strings to MaaS: Tracking a Commodity BadIIS Ecosystem
SOC Prime Bias: Medium
Cisco Talos Blog
Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud
SOC Prime Bias: Medium
Trend Micro
durabletask: TeamPCP’s Latest PyPI Supply Chain Compromise
SOC Prime Bias: Critical
wiz.io
Exposed RDP: The Misconfiguration That Still Pays Off for Attackers
SOC Prime Bias: Critical
Huntress
Steganography Secrets: Malware Hidden in Plain Sight
SOC Prime Bias: Medium
cofense.com
NG0002 Targets Chinese Academia with Weaponized Institutional Lures
SOC Prime Bias: Critical
Seqrite Labs
SHub Reaper | macOS Stealer Spoofs Apple, Google, and Microsoft in a Single Attack Chain
SOC Prime Bias: Medium
SentinelOne
How Storm-2949 turned a compromised identity into a cloud-wide breach
SOC Prime Bias: High
Microsoft Security Blog
Shai-Hulud Clones: TeamPCP Copycats Are Here
SOC Prime Bias: Critical
OX Security
Phantom Stealer Analysis: Inside a Two-Layer Attack Chain
SOC Prime Bias: Medium
Darkatlas