Active Threats
Explore the latest active threats being deployed by malicious actors as of 2026. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
PamStealer Shifts to Swift With a Server-Side Decryption Chain
SOC Prime Bias: High
jamfsoftware
From Payment Plan to Ransomware – Inside a Global Group Attack
SOC Prime Bias: Critical
cofense.com
The Tale of Two INC Ransom Notes
SOC Prime Bias: High
Huntress
Exvicy: A copycat of the ErrTraffic malware distribution framework
SOC Prime Bias: High
sekoia.com
Microsoft Teams Help Desk Impersonation: When IT Support Messages You First
SOC Prime Bias: High
ScamDrill
Macfinger ClickFix campaign
SOC Prime Bias: High
SANS Internet Storm Center
Larva-25012: A 2026 Proxyware Distribution Campaign
SOC Prime Bias: Medium
ASEC
How Click2Shell Exploits WordPress Theme Installation for RCE
SOC Prime Bias: Critical
picussecurity.com
TraderTraitor Backdoors Target Victims Outside the Cryptocurrency Sector
SOC Prime Bias: Critical
SentinelOne
ChainScript: Tracing a Node.js RAT Through the Blockchain
SOC Prime Bias: High
Blackpoint Cyber
