Active Threats
Explore the latest active threats being deployed by malicious actors as of 2026. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
UAT-10147 Uses Agentic AI to Expand Post-Compromise Activity
SOC Prime Bias: High
Cisco Talos Blog
Rust Supply Chain Attack Targets arrayref, internment, and append-only-vec
SOC Prime Bias: Critical
stepsecurity.io
Grandoreiro Targets Mexico with a New DLL Sideloading Technique
SOC Prime Bias: High
Acronis
SynkLoader Combines Multiple Evasion and Delivery Techniques
SOC Prime Bias: High
Expel
Agent Tesla BEC Attack Delivers an In-Memory Infostealer
SOC Prime Bias: High
KnowBe4
Kimsuky Uses Legitimate RMM Tools in Northeast Asia Campaigns
SOC Prime Bias: Critical
co.kr
AmnesiaStealer Uses Interactive Browser Hijacking on macOS
SOC Prime Bias: High
PolySwarm
ClearFake Campaigns Use WordlistLoader to Deploy Amatera
SOC Prime Bias: High
GenThreatLabs
Malware-as-a-Service Cocktail: ErrTraffic, Cruciferra, and EDR Evasion
SOC Prime Bias: Critical
eSentire
DEF CON-Themed Phishing Abuses Google Apps Script for Malware Delivery
SOC Prime Bias: High
Huntress
