Active Threats
Explore the latest active threats being deployed by malicious actors as of 2026. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Blind Eagle’s GitHub Loader Reveals a Persistent Operator
SOC Prime Bias: High
levelbluecyber
Carry-On Compromise: TA4922 Packs PackClient
SOC Prime Bias: High
Proofpoint
TerminalFix Campaign Builds Reverse Tunnels for Persistent Access
SOC Prime Bias: High
Microsoft Security Blog
Guildma (Astaroth) malware infection from Brazilian Portuguese email
SOC Prime Bias: High
SANS Internet Storm Center
The Aurora Files: Inside a High-Resolution Malware Investigation
SOC Prime Bias: Critical
cloudsek.com
Inside SHADOW-WATER-084: A Steganographic Loader-as-a-Service Delivering Remcos, LXBASE, and More
SOC Prime Bias: High
TrendAI
CVE-2026-62911 Enables Pre-Auth RCE on Exchange Server
SOC Prime Bias: Critical
GitHub
Ditto: A PowerShell and JavaScript Obfuscator
SOC Prime Bias: Medium
GitHub
Inhospitable: Mapping Russian Cyber Espionage Infrastructure
SOC Prime Bias: Critical
Validin
Play Ransomware Encryption: How It Works
SOC Prime Bias: Critical
GuidePoint Security
