Company
Blackpoint Cyber provides managed detection and response (MDR) services and a 24/7 security operations center, mainly for managed service providers.
Any.Run's researchers found a phishing kit running in 46 countries whose final payload is a signed copy of ScreenConnect or GoTo Resolve, which moves the defensive question from malware signatures to which remote-access tools may execute at all.
Reality
GreyNoise and Blackpoint Cyber trace the new PaperCut auth-bypass chain to one scanning address running AI agents against schools, which turns an unpatched print server from a maintenance ticket into a credential incident.
Perspective Coverage
6 publishersReality
PaperCut NG/MF 26.0.5, 25.0.13 and 24.1.10 carry every fix from three emergency patch rounds plus two regression fixes, while GreyNoise and Blackpoint Cyber count at least 395 organizations already breached.
Reality
Blackpoint's SOC worked an incident where a fake captcha on the victim company's own WordPress site ran a hidden PowerShell downloader, and the campaign's later stage sits in a blockchain contract no provider can pull.
Reality
Cisco Talos found the loader running from a WebDAV UNC path at a Ukrainian government organisation in April 2026, delivered by a ClickFix prompt whose JavaScript was stored on BNB Smart Chain. The primary payload is Amatera stealer.
Reality
Blackpoint found the framework because its operators left it in open web directories. The plumbing is what matters: tasking and results ride encrypted connections to a managed database, and a fake hostfxr.dll starts the agent.
Reality