Third-Party Risk Exposes Bank to Months-Long Cyberespionage Intrusion

"Sometimes the most damaging intrusions begin with the simplest oversights," Unit 42 wrote.

How the intrusion reached the bank through a third-party-managed gateway

Unusual activity on a European bank’s central IT system led its internal security team to escalate the incident and engage Unit 42. The intrusion originated through a third-party-managed external gateway appliance that “was not properly configured to enforce strict authentication.” Using compromised credentials, the attacker authenticated to internal systems via VPN-based access attempts that spanned several months.

The attacker's noisy reconnaissance and credential-testing campaign

Once inside, the actor did not move like a refined, surgical threat. Unit 42 observed multiple rounds of broad reconnaissance, with extensive host and network scans across a wide range of protocols and interactions with thousands of systems. The activity included automated scraping of internal documentation and data shares—enumerating operational and network shares and downloading pages and attachments through automated web requests.

Over several months the intruder also launched repeated password-guessing campaigns. Unit 42 reported brute-force authentication attempts that focused on administrator accounts. The overall pattern—large-scale scanning, repeated credential testing, and use of common system identifiers—led analysts to classify the actor as opportunistic rather than sophisticated. The behavior was noisy and showed “little effort to remain hidden or avoid detection.”

Attempted WSUS remote code execution and Cortex XDR containment

In a critical late-stage move the intruder attempted to exploit a Windows Server Update Services (WSUS) remote code execution vulnerability on the bank’s central configuration management server. That server was responsible for software distribution across the bank and represented a prime target for privilege escalation and long-term persistence.

At the moment the attacker tried to execute unauthorized code, Cortex XDR identified the activity and contained the threat before it could escalate. Unit 42’s account states the containment prevented the attacker from gaining a persistent foothold or moving laterally throughout the network.

Unit 42's forensic hunt and the bank's remediation steps

After being engaged, Unit 42 initiated a comprehensive threat-hunting effort. The team performed a deep forensic review of endpoint telemetry across approximately thousands of systems, alongside logs from dozens of Windows and Linux servers. Unit 42 found no additional attacker presence or persistent backdoors. Bank leadership then reviewed exposed documentation and rotated all compromised credentials, actions that Unit 42 reports “completely neutraliz[ed] the threat.”

As part of hardening the environment, the organization expanded its defensive coverage by deploying additional Cortex XSIAM and Cortex XDR licenses and broadened its incident response retainer service. Unit 42 also delivered prioritized recommendations to strengthen the bank’s security posture.

Core defensive controls the incident exposed

The case underscores that the intruder relied on gaps in foundational controls rather than advanced tradecraft. Unit 42 highlighted three core defenses that, if enforced, would have reduced the chance of compromise:

• Enforcing strict identity access controls
• Ensuring timely patching
• Using endpoint detection to stop lateral movement

Unit 42 framed these as the basic hygiene measures that would have prevented the attacker from exploiting an unpatched edge device or a VPN missing multi-factor authentication (MFA).

What this means for technologists, procurement leaders, and affected enterprises

Technologists and security teams: The incident is a reminder to verify that externally managed appliances enforce strong authentication and to monitor for noisy reconnaissance and brute-force campaigns across administrative accounts. Endpoint detection directly stopped the attempted escalation in this case.

Procurement leaders and third-party managers: Relying on a third-party-managed gateway created an operational dependency; configuration gaps on that appliance enabled initial access. The organization’s response—rotating compromised credentials and expanding detection licenses—illustrates how contractual and technical controls intersect.

Affected enterprises and leadership: Rapid engagement of incident responders, prioritized remediation, and strategic guidance restored confidence for bank leadership. Unit 42’s verification that no persistent backdoors remained allowed the organization to move from containment to hardening.

The episode is simple and stark: an opportunistic attacker, sustained access across months, and a near-miss that was stopped by containment and hunt. Unit 42 validated the root cause, closed the immediate risk, and recommended steps to reduce the same exposure in the future. For organizations with third-party-managed infrastructure, the concrete lesson is this—basic configuration and identity controls matter as much as any advanced detection tool.

Read the original Unit 42 write-up: https://unit42.paloaltonetworks.com/noise-inside-network-third-party-risk/