Active Threats
Explore the latest active threats being deployed by malicious actors as of 2026. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
THREAT OF THE MONTH
CVE-2026-109618 and CVE-2026-109619: PHP2Shell RCE Flaws
SOC Prime Bias: Critical
Huntress
SlippyNunchucks Malware Campaign Exploits Sogou Brand Promotion
SOC Prime Bias: Critical
welivesecurity.com
SolanaCry Malware Steals Crypto Wallets from Web-Browsing AI Agents
SOC Prime Bias: High
air.security
Gorbag Malware Campaign Harvests Intelligence from Ukraine
SOC Prime Bias: Critical
welivesecurity.com
Qilin Ransomware in 2026: Evolution, Code Changes, and Tactics
SOC Prime Bias: Critical
Seqrite Labs
BITTER Expands Its Malware Arsenal with PapRAT
SOC Prime Bias: High
Fortinet Blog
StyleSmuggler Attacks Deploy PSK Agent RAT Against Magento Stores
SOC Prime Bias: Critical
Blog
APT Attack Trends in South Korea: September 2026
SOC Prime Bias: Critical
ASEC
CVE-2026-111357 and CVE-2026-118527: Ivanti Zero-Days Exploited in the Wild
SOC Prime Bias: Critical
Rapid7
ESC1 and ESC8 Attack Paths: From Social Engineering to AD CS Abuse
SOC Prime Bias: Critical
Microsoft Security Blog
Star Blizzard Threat Actor Profile: Espionage Tactics and Tools
SOC Prime Bias: Critical
CYFIRMA
