Blackpoint Cyber's 2026 Report: Credential Abuse and RMM Tool Exploitation
In 2026, Blackpoint Cyber's annual threat report highlighted a significant shift in cyberattack methodologies, with a notable increase in the exploitation of legitimate access methods over traditional vulnerability exploits. The report revealed that 32.8% of incidents involved SSL VPN abuse, where attackers utilized valid but compromised credentials to establish seemingly legitimate sessions, facilitating rapid lateral movement within networks. Additionally, 30.3% of incidents featured the misuse of Remote Monitoring and Management (RMM) tools, particularly ScreenConnect, which was present in over 70% of rogue RMM cases. This trend underscores the evolving tactics of threat actors who are leveraging trusted IT tools to gain and maintain unauthorized access, thereby evading conventional security measures. The current relevance of this incident lies in the growing prevalence of identity-driven attacks and the strategic use of legitimate tools for malicious purposes. Organizations must recognize that traditional security controls may be insufficient against such tactics, necessitating enhanced monitoring of credential usage and the implementation of stringent access controls. The rise in these sophisticated methods highlights the urgent need for adaptive security strategies to effectively counteract the evolving threat landscape.
Kill Chain
