Third-party VPN control left a bank exposed for months
Unit 42 says a European bank faced months of unauthorized VPN-based access that began at a third-party-managed external gateway appliance. The activity looked like espionage, but the entry point was a perimeter control that was not properly enforcing strict authentication.
Once inside through compromised credentials, the attacker kept testing passwords, scanning internal systems, and scraping internal documentation and network shares. The later WSUS attack shows they were also probing for deeper access, but the core weakness was the front-end identity and hygiene gap that let them keep trying keys at the gateway.
For banks and others that outsource remote access, the lesson sits in the control plane ahead of the network: if a managed VPN or perimeter appliance is weakly administered, internal controls can be bypassed for a long time without a flashy exploit. The exposure that remains is persistent authenticated access through a trust point you do not directly operate.
The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk
Unit 42 dissects a cyberattack targeting a European bank's IT infrastructure, delivering concrete defense strategies to help organizations detect and counter comparable threats.