Remote access solutions and dependable admin tools are fundamental to modern organizational function. Blackpoint Cyber’s 2026 Threat Report notes they’re increasingly the initial point of entry for intrusions.

The report, based on examining thousands of security incidents, reveals a change in attacker tactics. Instead of just using software weaknesses, attackers often gained entry using correct credentials, standard tools, and normal user actions.

The report analyzes these trends, records where intrusions were stopped, and outlines key defenses derived from analyzing incident responses in 2025.

Additional details and incident scenarios will be discussed in a live webinar by Blackpoint Cyber.

➡️ Sign up here

The report’s incident analysis showed attackers were more likely to use legitimate login methods than software vulnerabilities as initial access.

SSL VPN exploitation accounted for 32.8% of identified incidents, becoming a primary avenue for initial access. In many instances, attackers used valid but compromised usernames and passwords, making VPN sessions appear legitimate to security systems.

Once inside, these sessions frequently provided extensive internal access, allowing attackers to quickly target valuable assets without immediate detection.

The report also highlights the frequent misuse of Remote Monitoring and Management software for entry and long-term access.

RMM misuse occurred in 30.3% of identified incidents, with ScreenConnect involved in over 70% of those cases. Because these tools are standard for IT management, unrecognized installations often resembled expected behavior and were difficult to spot without good oversight.

The report states environments using many remote access options were more likely to see rogue instances blend in unnoticed.

Even though legitimate access facilitated intrusions, user activity was responsible for most incidents overall.

Fake CAPTCHA and ClickFix ploys made up 57.5% of all identified incidents, being the most common attack type in the report.

Instead of using program flaws, these ploys used misleading prompts. Users were told to paste commands into the Windows Run interface as part of a supposed routine check. Execution used built-in Windows tools, bypassing typical malware downloads or exploitation.

Even with multi-factor authentication active in many cloud environments involved in the investigations, account breaches still happened.

Adversary-in-the-Middle phishing caused about 16% of cloud account shutdowns in the report. MFA worked, but attackers stole authenticated session tokens issued after successful MFA, using them to access cloud services.

From the cloud platform’s viewpoint, this activity was a valid, authenticated connection.

Across industries, environments, and attack techniques, the report shows a recurring trend: successful intrusions often exploited normal, routine actions.

Instead of depending on new exploits or complex malware, attackers misused routine practices like remote logins, reliable apps, and standard user actions. Based on the analyzed attack paths, the report emphasizes several defense priorities:

• Treat remote connections as high-risk, high-impact activities
• Keep a full list of permitted RMM software and remove obsolete or unused agents
• Limit the installation of unauthorized programs and restrict running programs from user-writable areas
• Use Conditional Access protocols to assess device security, location, and session risk

These trends were seen in frequently affected sectors like manufacturing, healthcare, MSPs, financial services, and construction.

For teams wanting to understand these intrusion styles, Blackpoint Cyber will discuss key findings, examples, and safety measures from the 2026 Threat Report during a live webinar.

➡️ Sign up to obtain the 2026 Annual Threat Report

Sponsored and written by Blackpoint Cyber.