Third-Party VPN Access Enabled a Months-Long Intrusion at a European Bank

Summary

A threat actor used compromised credentials and a poorly configured third-party gateway to access a European bank, scan its network, and target internal systems. Cortex XDR stopped an attempted WSUS exploit before persistence or lateral movement.

Key points

The intrusion began through a third-party-managed external gateway that did not enforce strict authentication; the attacker used compromised credentials.
Over several months, the attacker scanned thousands of systems, tried passwords against internal systems—especially administrator accounts—and scraped internal documentation and data shares.
The attacker attempted to exploit a WSUS remote code execution vulnerability on the bank’s central configuration management server.
Cortex XDR detected and contained the attempted unauthorized code execution, preventing persistence and lateral movement.
Unit 42’s forensic review found no additional attacker presence or persistent backdoors.
The bank reviewed exposed documentation, rotated compromised credentials, and received recommendations to strengthen security controls.

Article Details

Victim Organization: European bank (name not disclosed)
Incident Type: Unauthorized intrusion involving compromised credentials, VPN-based access attempts, internal reconnaissance, password guessing, and attempted exploitation of a WSUS remote code execution vulnerability.
Data Types Exposed: Internal documentation pages and attachments
Operational and network share data
Operational Impact: The attacker accessed internal systems and scraped documentation pages and attachments. An attempt to execute unauthorized code on the central configuration management server was detected and contained by Cortex XDR. The investigation found no persistent footholds or additional attacker presence; the article does not report disruption to bank operations.
Ransom Or Extortion: None reported.
Claim Status: confirmed