Active Threats
Explore the latest active threats being deployed by malicious actors as of 2026. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
BlueNoroff Uses ClickFix in a DPRK-Linked Attack Campaign
SOC Prime Bias: Critical
JUMPSEC
TAG-195 Upgrades MaaS Ecosystem with Modular Tools
SOC Prime Bias: High
recordedfuture.com
VECT 2.0 Ransomware: Breaking Down the Attack Chain
SOC Prime Bias: Critical
extrahop.com
ClearFake / CastleLoader Abuses Paste-and-Run Techniques for Malware Delivery
SOC Prime Bias: High
Red Canary
wp2shell Targets WordPress with Pre-Auth RCE and Command Execution
SOC Prime Bias: Critical
elastic.co
Kimsuky Targets Victims by Impersonating Diplomats
SOC Prime Bias: Critical
ASEC
Dolphin X Stealer Targets 300+ Apps and Profiles Users with AI
SOC Prime Bias: High
varonis.com
Phantom Stealer Campaign Abuses Trusted Business Workflows
SOC Prime Bias: High
Seqrite Labs
New Gomir Variant Used in Kimsuky Attack on South Korean Groupware Vendor
SOC Prime Bias: Critical
co.kr
Cruciferra: Analyzing a Sophisticated Crypter Service
SOC Prime Bias: High
Proofpoint
