Threat Pulse: 69th Edition
Featured Incident
Hide and Seek
What we’re seeing
- The Blackpoint SOC alerted to HideUL, a tool that hides installed software, running through a malicious ScreenConnect instance on a host.
- Additional investigation identified the activity to a .zip file posing as Google Meet that contained a ScreenConnect installer.
- A second ScreenConnect instance contacted a malicious IP address, downloaded HideUL and helper scripts, and set its service to restart automatically.
What the Blackpoint SOC did
- The Blackpoint SOC isolated the host immediately upon identification of suspicious activity and confirmed no signs of lateral movement.
- The Blackpoint SOC conducted additional analysis in order to identify initial access and confirm the full attack chain.
Why this matters
- ScreenConnect is a legitimate remote support software, allowing it to blend into normal IT tooling during routine review; HideUL conceals it from the installed programs list.
- Deploying two remote monitoring and management (RMM) tools on the host, the threat actor has two methods of access, requiring security solutions to first identify their presence within the environment, and then identify their malicious use as well.
What Blackpoint is Doing
Blackpoint Cyber has detections in place for the behaviors observed in this attack chain; additionally, Blackpoint Cyber’s Managed Application Control (MAC) is highly effective against unauthorized ScreenConnect activity.
The SOC provides 24/7 monitoring and response, while APG tracks changes in adversary behavior, campaigns, and vulnerabilities to provide intelligence that supports detection, investigation, and response. Together, these capabilities help identify and respond to malicious activity before it can escalate into broader operational or business impact.
Recommendations
- Block the use of unwanted tools via Application Control Software, Blackpoint’s Managed Application Control (MAC), or prevent the installation of new software by users within Group Policy.
- Legitimate installations typically reside in system-level directories. If ScreenConnect is found in user-level paths like Downloads, AppData, or alongside suspicious script files, treat it as a potential indicator of compromise.
- Harden detection rules within AV/EDR solutions to flag ScreenConnect installs, especially if unsigned or launched from non-standard locations.
- Restrict downloads of zip files and executables from the browser and remove local admin rights from standard users so a downloaded installer cannot install a SYSTEM-level service.
BROC Weekly Snapshot
What changed. What didn’t. What matters.
Campaign Statuses
In Case You Missed It
On October 20, 2026, the PHP Security Team issued an advanced notice of two critical, unauthenticated remote code execution vulnerabilities, following a leak of embargoed details. The next day, PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 for CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2. Partners should ensure patches have been applied immediately as patching is the only full mitigation.
Blackpoint Cyber’s Adversarial Pursuit Group (APG) released threat notices and independently validated the reported vulnerabilities. Exploit code is now public. Multiple researchers have reported attempted exploitation; the Blackpoint SOC has not observed activity consistent with exploitation within our managed environments at the time of writing.
Social Content
Threat Notices
DATE PUBLISHEDOctober 26, 2026
AUTHORBlackpoint Cyber
SHARE ON
The Cost of Waiting
What Identity Attacks Cost the MSP Stolen credentials don't trip alarms. Once an attacker is authenticated, they look like anyone else, and most tools aren't watching what happens next. Learn what closing the identity response gap looks like: how identity attacks happen, where response slows down, and the questions to ask any ITDR vendor.
*Identity-based techniques play a role in nearly 90% of incident investigations