Active Threats
Explore the latest active threats being deployed by malicious actors as of 2026. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure
SOC Prime Bias: Critical
Acronis
Inside The Gentlemen’s Attack Chain and Tradecraft
SOC Prime Bias: High
intel471.com
APT-Q-27 Dragon Breath: RONINGLOADER and Gh0st RAT Analysis
SOC Prime Bias: Critical
picussecurity.com
DeadLock Ransomware: Inside Its Rust Encryptor and Recovery Network
SOC Prime Bias: High
Microsoft Security Blog
CNCMachineRMS Emerges at the End of a BabaDeda Attack Chain
SOC Prime Bias: Critical
levelbluecyber
Gunra Ransomware Uses Multithreaded ChaCha20 Encryption
SOC Prime Bias: Critical
picussecurity.com
Kimsuky Expands Attack Operations with AI and Local LLMs
SOC Prime Bias: Critical
co.kr
ScreenConnect Spread at Scale Through App Store-Themed Phishing
SOC Prime Bias: High
levelbluecyber
CrowdStrike Hunts Shell Command Obfuscation on VMware ESXi
SOC Prime Bias: Critical
crowdstrike.com
How 2026’s Least-Prevented Ransomware Families Evade Defenses
SOC Prime Bias: Critical
picussecurity.com
