Active Threats
Explore the latest active threats being deployed by malicious actors as of 2026. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
ClearFake / CastleLoader Abuses Paste-and-Run Techniques for Malware Delivery
SOC Prime Bias: High
Red Canary
wp2shell Targets WordPress with Pre-Auth RCE and Command Execution
SOC Prime Bias: Critical
elastic.co
Kimsuky Targets Victims by Impersonating Diplomats
SOC Prime Bias: Critical
ASEC
Dolphin X Stealer Targets 300+ Apps and Profiles Users with AI
SOC Prime Bias: High
varonis.com
Phantom Stealer Campaign Abuses Trusted Business Workflows
SOC Prime Bias: High
Seqrite Labs
New Gomir Variant Used in Kimsuky Attack on South Korean Groupware Vendor
SOC Prime Bias: Critical
co.kr
Cruciferra: Analyzing a Sophisticated Crypter Service
SOC Prime Bias: High
Proofpoint
CVE-2026-0257 Exploitation and the Path to Qilin Ransomware
SOC Prime Bias: Critical
Arctic Wolf
Fake Coding Interviews Used in a New North Korean Credential Theft Campaign
SOC Prime Bias: Critical
elastic.co
ChainVeil Returns to Target the Vite Ecosystem
SOC Prime Bias: Critical
Checkmarx
