Blackpoint Cyber Report Finds Intrusions Often Use Legitimate Access Paths
Summary
Blackpoint Cyber’s 2026 Annual Threat Report, based on thousands of investigations, finds that intrusions often use legitimate access, remote-management tools, and social engineering. It highlights SSL VPN abuse, ClickFix-style campaigns, and session-token reuse after-M
Key points
- The report draws on thousands of security investigations and describes activity observed throughout 2025.
- SSL VPN abuse accounted for 32.8% of identifiable incidents; attackers often used compromised credentials.
- RMM abuse appeared in 30.3% of identifiable incidents, and ScreenConnect was present in over 70% of rogue RMM cases.
- Fake CAPTCHA and ClickFix-style campaigns accounted for 57.5% of identifiable incidents, often directing users to run built-in Windows commands.
- Adversary-in-the-Middle phishing and reuse of authenticated session tokens after MFA accounted for about 16% of cloud account disables documented in the report.
- The report describes a Roadk1ll implant using WebSocket-based communication to pivot across systems and maintain access.
- Recommendations include inventorying approved RMM tools, restricting unapproved installations, and applying Conditional Access controls.
Article Details
- Publisher
- Blackpoint Cyber
- Report Period
- 2025
- Scope
- Patterns observed in security investigations, including initial access, RMM abuse, social engineering, cloud account compromise, and network pivoting.
- Sample Size
- Thousands of security investigations; exact count not disclosed.
- Key Statistics
- SSL VPN abuse accounted for 32.8% of identifiable incidents.
- RMM abuse appeared in 30.3% of identifiable incidents; ScreenConnect was present in more than 70% of rogue RMM cases.
- Fake CAPTCHA and ClickFix-style campaigns accounted for 57.5% of identifiable incidents.
- Adversary-in-the-Middle phishing accounted for approximately 16% of cloud account disables documented in the report.
- Recommendations
- Treat remote access as high-risk, high-impact activity.
- Maintain an inventory of approved RMM tools and remove unused or legacy agents.
- Restrict unapproved software installations and limit execution from user-writable directories.
- Apply Conditional Access controls that evaluate device posture, location, and session risk.
MITRE ATT&CK
T1078 · Valid AccountsThe report describes attackers using valid, sometimes compromised, credentials to access networks.T1204.004 · Malicious Copy and PasteClickFix-style prompts instructed users to paste commands into the Windows Run dialog.T1219 · Remote Access ToolsThe report describes unauthorized use of legitimate RMM software, including ScreenConnect, for access and persistence.T1550.004 · Web Session CookieAttackers reportedly reused authenticated session tokens to access cloud services after MFA.T1557.003 · DHCP SpoofingThe report describes Adversary-in-the-Middle phishing used to capture authenticated session tokens after MFA.
Malware
Vendors
Products
Industries
ConstructionThese patterns were documented across frequently targeted sectors, including manufacturing, healthcare, MSPs, financial services, and construction.Financial ServicesThese patterns were documented across frequently targeted sectors, including manufacturing, healthcare, MSPs, financial services, and construction.HealthcareThese patterns were documented across frequently targeted sectors, including manufacturing, healthcare, MSPs, financial services, and construction.ManufacturingThese patterns were documented across frequently targeted sectors, including manufacturing, healthcare, MSPs, financial services, and construction.MSPsThese patterns were documented across frequently targeted sectors, including manufacturing, healthcare, MSPs, financial services, and construction.