Active Threats
Explore the latest active threats being deployed by malicious actors as of 2026. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials
SOC Prime Bias: Critical
zscaler.com
Abyssos: Technical Analysis of a New Modular RAT
SOC Prime Bias: High
zscaler.com
AmnesiaStealer Hijacks Chromium Browsers on macOS
SOC Prime Bias: High
jamfsoftware
PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure
SOC Prime Bias: Critical
Acronis
Inside The Gentlemen’s Attack Chain and Tradecraft
SOC Prime Bias: High
intel471.com
APT-Q-27 Dragon Breath: RONINGLOADER and Gh0st RAT Analysis
SOC Prime Bias: Critical
picussecurity.com
DeadLock Ransomware: Inside Its Rust Encryptor and Recovery Network
SOC Prime Bias: High
Microsoft Security Blog
StopRansomware: Gunra Ransomware Threat Analysis
SOC Prime Bias: Critical
CISA
CNCMachineRMS Emerges at the End of a BabaDeda Attack Chain
SOC Prime Bias: Critical
levelbluecyber
Gunra Ransomware Uses Multithreaded ChaCha20 Encryption
SOC Prime Bias: Critical
picussecurity.com
