Topic starter
23/10/2026 12:47 am
TL;DR: Attackers are pairing ClickFix, rogue RMM, blockchain-based command and control, and AI-managed exploitation to keep campaigns moving, with Blackpoint Cyber in September noting shifting infrastructure and payloads. Detection and response need to follow behaviour, identity artefacts, and runtime tasking when indicators keep changing.
Editorial analysis by NHI Mgmt Group, based on content published by Blackpoint Cyber: “Notes from the Chief Security and Trust Officer: September 2026”.
Key questions
Q: Why do adaptive intrusion campaigns increase identity and session risk?
A: They increase identity and session risk because once attackers obtain browser credentials, tokens, or remote access footholds, they can keep moving even when the original payload changes.
Q: What are the signs that command and control is being resolved dynamically?
A: Look for implants that fetch tasking or panel addresses at runtime, especially when the destination changes without a new payload build.
Q: What breaks when attackers use trusted authentication flows for initial access?
A: Traditional password-centric controls break because the login itself is no longer the malicious act.
Practitioner guidance
- Hunt for trusted-workflow abuse Correlate ClickFix-style user interaction, rogue RMM installs, and unusual Run dialog activity with subsequent process creation and network egress.
- Prioritise runtime C2 detection Detect malware that resolves tasking dynamically through smart contracts, DNS lookups, or other runtime indirection rather than static destinations.
- Expand identity telemetry around browser and session artefacts Watch for browser credential theft, token use, possible PRT access, and anomalous sign-ins that follow remote-access or social-engineering chains.
Bottom line: Attackers are increasingly combining trusted workflows, remote administration abuse, and dynamic command infrastructure to make intrusions harder to pin to a single indicator.
Glossary terms: Composite Intrusion Orchestration, ClickFix, Dynamic Command and Control, Verification Artefact
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
Behavioural persistence now matters more than indicator persistence: attackers are designing operations that can swap domains, panels, and payload names without changing the underlying intrusion pattern. That weakens controls that still depend on static blocking or one-time compromise indicators. The practical conclusion is that detection must follow execution flow, not just known bad infrastructure.
A question worth separating out:
Q: How should security teams respond when a campaign can keep changing infrastructure?
A: They should focus on containment decisions that do not depend on static indicators alone. That means isolating the host, reviewing nearby identity activity, looking for credential access and lateral movement signals, and validating whether remote-access tooling, persistence, or proxy behaviour suggests the intrusion is still active.
👉 Read our full editorial: September’s attacker tradecraft shifts toward adaptive intrusion workflows
This post was modified 6 days ago by NHI Mgmt Group