Skip to content

Back to the catalog

The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk
unit42.paloaltonetworks.comarticle

The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk

Unit 42 case study of an intrusion at a European bank that began through a third-party-managed VPN gateway lacking strict authentication. The attacker used compromised credentials, ran noisy network scans, brute-forced administrator accounts and scraped internal documentation. A WSUS remote code execution attempt on the configuration management server was stopped by Cortex XDR, and threat hunting found no persistence.

TL;DR Describes how an opportunistic attacker used a misconfigured third-party VPN gateway to reach a bank's network before Cortex XDR blocked a WSUS exploit attempt.
Open original ↗

Organisations named here

  • third-party risk

Technologies named here

  • Cortex XDR
  • Multi-factor authentication
  • Windows Server Update Services
  • VPN
  • Unit 42
  • Cortex XSIAM
  • Unit 42 Global Incident Response Report
  • Unit 42 incident response retainer service

Techniques named here

  • Valid Accounts
  • Brute Force
  • Automated web scraping of internal documentation
  • Brute force / password guessing
  • Network and host scanning (internal reconnaissance)
  • Network share enumeration
  • Threat hunting and forensic review
  • WSUS remote code execution exploitation

Related in Blue Team & Detection