Blackpoint Cyber (Adversary Pursuit Group)
blackpoint-cyber · B · active
https://blackpointcyber.com/blog/
Independent reverse engineering of the ScreenConnect SCKit toolkit and a test of its exploit chain against a current release; read cleanly with extract. | Fetch: `extract <URL>` for listing and posts. | Added 2026-11-13 as a candidate (promote to active after 3 contributing runs). | 2026-11-14: promoted to active (cited by published entries from 3 distinct runs).
Cited in 3 entries
Citation cadence
Citation days per ISO week (20 weeks of coverage span, total 3).
- ScreenConnect: commands pushed through Run Command to at least 288 managed endpoints at 48 Huntress customers within 90 minutes on 2026-11-11 installed a rogue second client and the SCKit toolkit; Huntress links the activity to the RMM+ extension, whose versions 1.0.31 and 1.0.32 accepted a blank access key2026-11-12
- Blackpoint Cyber documents "Avalon": a modular framework bundling credential theft, lateral movement and CrownX ransomware behind an MSBuild loader2026-07-04
- CVE-2026-48558: SimpleHelp RMM OIDC authentication bypass (CVSS 3.1 10.0) exploited to plant technician sessions that deliver the TaskWeaver loader and Djinn Stealer2026-06-30