person

Andi Ursry

Threat researcher who publishes malware analysis under the Blackpoint Cyber Adversary Pursuit Group byline.

Current clusters

ChainScript RAT resolves its command channel through a Polygon smart contract

Blackpoint says a fake Spotify MSI, launched through msiexec.exe, ends with a Node.js agent that reads its live C2 address off a Polygon contract. The same implant has also shipped as Zoom and Teams.

Publishers:thehackernews.com

Reality

Evidence60
Adoption45
Hype gap+10
Incentives70
Confidence55