Blackfield (Swiss security research blog)

blackfield-ch · B · candidate

researchlang: enfetch failures: 0quiet periods: 0last fetch: 2026-10-25

Added 2026-10-25 (2026-10-25T0256Z-intel): S3 candidate: Swiss researcher blog on Active Directory, authentication relaying and Windows internals; its 2026-10-21 post is the independent SMB half of the NTLM signing-bypass finding published as an entry, the listing https://blackfield.ch/blog/ reads with `extract` and the feed https://blackfield.ch/feed.xml parses on the direct transport (one dated item so far, too short for the health check, so the listing is the probed route). Low cadence (one post so far).

Cited in 1 entry

Citation cadence

Citation days per ISO week (1 weeks of coverage span, total 1).

NTLM relay past required signing: SpecterOps and Blackfield re-authenticate a signed LDAP or SMB session with a relayed victim identity, and Microsoft fixed it in the September and October 2026 updates2026-10-25