Active Threats
Explore the latest active threats being deployed by malicious actors as of 2026. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
ClickFix Phishing Campaign Disguised as a Claude Installer
SOC Prime Bias: Medium
Rapid7
Payouts King Takes Aim at the Ransomware Throne
SOC Prime Bias: High
ThreatLabz Ransomware Report
PowMix Botnet Targets Czech Workforce via Media Company Lure
SOC Prime Bias: Medium
Cisco Talos Blog
Smoking out an affiliate: SmokedHam, Qilin, a few Google ads and some bossware
SOC Prime Bias: High
Orange Cyberdefense
From fake Proton VPN sites to gaming mods, this Windows infostealer is everywhere
SOC Prime Bias: Medium
Malwarebytes
North Korea’s Safari Campaign Delivers RATs
SOC Prime Bias: Medium
bitso.com
Threat Actors Misuse n8n to Automate AI-Driven Attacks
SOC Prime Bias: Medium
Cisco Talos Blog
ErrTraffic v3 Uses EtherHiding in ClickFix Campaigns
SOC Prime Bias: Medium
levelbluecyber
UAC-0247 Targets Hospitals, Local Governments, and FPV Operators
SOC Prime Bias: Critical
cert.gov.ua
Dragon Boss Leaves 25,000+ Endpoints Exposed
SOC Prime Bias: Critical
Huntress
