Active Threats
Explore the latest active threats being deployed by malicious actors as of 2026. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
APT-Q-27 Malware Campaign Focuses on Web3 Customer Support
SOC Prime Bias: Critical
zeroShadow
MacOS Stealers, Observed: What Defenders Should Watch For
SOC Prime Bias: Medium
objective_see
I’d come running back to EU again: TA416 resumes European government espionage campaigns
SOC Prime Bias: Critical
Proofpoint
Cookie-Controlled PHP Web Shells: Stealth Tradecraft on Linux Hosts
SOC Prime Bias: Medium
Microsoft Security Blog
Qilin EDR Killer Infection Chain
SOC Prime Bias: High
Cisco Talos Blog
Mustang Panda and PlugX: A Deep Dive into Phishing-Led Loader Operations
SOC Prime Bias: Critical
0x3oBAD
The Certificate Decoding Illusion: How Blank Grabber Stealer Hides Its Loader
SOC Prime Bias: Medium
Splunk
DeepLoad Malware Pairs ClickFix Delivery with AI-Generated Evasion
SOC Prime Bias: Medium
ReliaQuest
Unpacking Augmented Marauder’s Multi-Pronged Casbaneiro Campaigns
SOC Prime Bias: High
BlueVoyant
CrySome RAT : An Advanced Persistent .NET Remote Access Trojan
SOC Prime Bias: Medium
CYFIRMA
