Active Threats
Explore the latest active threats being deployed by malicious actors as of 2026. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
THREAT OF THE MONTH
StopRansomware: Gunra Ransomware Threat Analysis
SOC Prime Bias: Critical
CISA
Citrix NetScaler PreAuth Command Injection CVE-2026-88771
SOC Prime Bias: Critical
watchTowr Labs
UAT-11587 Targets Asian Government and Policy Organizations with Antino Backdoor
SOC Prime Bias: High
Cisco Talos Blog
Star Blizzard Uses RedFlick to Enhance Phishing and Malware Deployment
SOC Prime Bias: Critical
Microsoft Security Blog
Phishing Abuses RMM Tools for Persistent Access
SOC Prime Bias: High
Microsoft Security Blog
Citrix NetScaler ADC and Gateway Appliances Targeted in Active Attacks
SOC Prime Bias: Critical
Google Cloud Blog
ShinyHunters Resumes Large-Scale Attacks Targeting Oracle PeopleSoft
SOC Prime Bias: Critical
Google Cloud Blog
TASK#STOMP: PowerShell Backdoor for Document Theft and Remote Access
SOC Prime Bias: High
Securonix
Uncovering a SectopRAT Variant Embedded in Legitimate Software
SOC Prime Bias: High
Fortinet Blog
Custom GPTs Abused in ClickFix Campaign to Deliver RAT Malware
SOC Prime Bias: High
Huntress
APT36-Linked Campaign Uses KMS Auto in a Multi-Stage Intrusion
SOC Prime Bias: High
K7 Labs
