The attacker was not subtle. Over several months, someone with stolen credentials scanned thousands of systems inside a European bank's network, hammered administrator accounts with password guesses and scraped internal documentation page by page. What let them in was not a clever exploit but a gateway run by a third party that was not configured to enforce strict authentication.
The case comes from Palo Alto Networks' Unit 42 incident response team, in a write-up by Antonio Diaz and Ruben Castillo published on October 13. The bank is not named. The lesson the researchers draw is blunt: an intruder does not need to be sophisticated when the basics are missing.
A supplier's gateway was the open door
The bank's internal security team spotted unusual activity on its central IT system and found unauthorized VPN-based access attempts stretching back several months. According to Unit 42, the intrusion started at a third-party-managed external gateway appliance that lacked strict authentication. Using compromised credentials, the attacker authenticated to internal systems and began looking around.
The investigators do not say how the credentials were obtained, and they do not attribute the activity to a known group. At first the activity looked like a stealthy espionage campaign. On closer inspection, Unit 42 concluded it did not match the behaviour of a sophisticated actor.
Loud scanning, password spraying and document scraping
Once inside, the intruder ran multiple rounds of reconnaissance, scanning hosts and networks across a wide range of protocols and touching thousands of systems. Unit 42 describes it as casting a net to find as many access points as possible rather than a targeted strike.
Over a few months the attacker launched repeated password-guessing campaigns against internal systems, focusing on administrator accounts. In parallel they went after the bank's internal documentation and data shares, using automated web requests to scrape individual pages and attachments and enumerating operational and network shares. The noise of the scanning and logins, plus the use of common system identifiers, pointed the researchers to an opportunistic attacker making little effort to hide.
Stopped at the software distribution server
The final move was the dangerous one. The intruder tried to exploit a remote code execution vulnerability in Windows Server Update Services (WSUS) on the bank's central configuration management server, the machine that distributed software across the organization. Control of that server would have offered a route to privilege escalation and long-term persistence. Unit 42 says the company's endpoint protection blocked the code execution attempt and contained the threat before the attacker could gain a foothold or move laterally.
A follow-up hunt across endpoint telemetry from thousands of systems and logs from dozens of Windows and Linux servers found no further attacker presence or backdoors. The bank reviewed the exposed documentation and rotated every compromised credential.
Enforce MFA on every remote entry point, including suppliers'
Unit 42's recommendations are deliberately unglamorous: enforce strict identity and access controls, patch on time, and use endpoint detection that can stop lateral movement. In practice that means auditing every externally reachable gateway, including those a supplier manages on your behalf, for multi-factor authentication, and alerting on high-volume internal scanning and repeated failed admin logins, both of which were present here for months.
It is the same pattern seen in a recent Japanese breach where patching the VPN was not enough. Edge devices, and the people who run them for you, are part of your attack surface. This attacker was noisy and still got months of access. A quieter one, given the same open door, would not have been caught by the noise.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.