Active Threats
Explore the latest active threats being deployed by malicious actors as of 2026. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Ivanti Connect Secure Zero-Days Chained for Unauthenticated Compromise
SOC Prime Bias: Critical
Volexity
CVE-2026-85884: WPAD LPAC and WHESVC Privilege Escalation
SOC Prime Bias: High
GitHub
MALFEX Campaign Moves Malicious npm Loader Into a Windows DLL
SOC Prime Bias: Critical
SafeDep
macOS Mirage: Dynamic Analysis and Sigma Detections for Apple Silicon
SOC Prime Bias: High
virustotal.com
RSVP to Disaster: How One Click Installs a RAT
SOC Prime Bias: High
cofense.com
DarkBlinders Campaign Targets Victims With Advanced Espionage Tactics
SOC Prime Bias: Critical
dreamgroup.com
JPCERT/CC Issues Cybersecurity Alert Following Surge in Unauthorized Access Incidents and Personal Data Breaches Across Japanese Organizations
SOC Prime Bias: High
JPCERT/CC
Thousands of Self-Hosted Metabase Instances Exposed by CVE-2026-72898
SOC Prime Bias: Critical
Dataminr
Operation GitPower: Kimsuky Espionage Against Ukraine
SOC Prime Bias: Critical
co.kr
Kimsuky-Linked Campaigns Highlight Evolving Ransomware Distribution Tactics
SOC Prime Bias: High
ASEC
