- Unit 42 reports that an opportunistic attacker entered a European bank through a third-party-managed gateway that did not enforce strict authentication.
- The attacker was noisy and easy to see, yet missing basics still gave them a way in for months.
- Leaders should ask who manages their remote-access devices, whether sign-in rules are enforced on them, and who reviews the logs.
Many people assume a big breach needs a clever attacker. A recent Unit 42 case study shows the two can be unrelated. The way in was a gateway run by someone else.
What Unit 42 found
Unit 42, the incident response team at Palo Alto Networks, published the case on October 13, 2026. A bank in Europe noticed odd activity on its central IT system. Its own security staff then found repeated attempts to get in over VPN. They had gone on for several months. The bank hired Unit 42 to measure the damage and look for lasting footholds.
The pattern looked like patient spying. Unit 42 says it was not. The entry point was an internet-facing gateway device managed by a third party. That device was not set up to demand strict sign-in checks. The attacker logged in with compromised credentials. The report does not say how they were obtained.
How the attack worked
Once inside, the attacker looked around. Unit 42 describes several rounds of scans across many protocols. They touched thousands of systems. It was a wide net, not a precise strike.
Then came password guessing. Over a few months, the attacker ran repeated brute-force campaigns aimed at administrator accounts. Brute force means trying huge numbers of passwords until one works. The attacker also used automated web requests to copy pages and attachments from internal documentation. They listed network shares as well.
Last, the attacker tried to exploit a remote code execution flaw in Windows Server Update Services (WSUS). It sat on the central configuration management server, which pushed software across the bank. Unit 42 says control of that server would give an intruder a route to higher privileges and a lasting presence. The source gives no CVE ID for the flaw.
The attempt failed. Unit 42 says Cortex XDR, Palo Alto Networks' endpoint detection product, spotted the unauthorized code and contained it. The attacker did not gain a lasting foothold or move sideways through the network.
The idea: you can outsource the device, not the exposure
The lesson here is about ownership. A third party managed the weak device. The exposure still belonged to the bank. A remote-access gateway is a front door. A contract may say a vendor runs the door. The bank still lives with whatever the door allows.
Unit 42 also says the attacker was unsophisticated. The scans and login attempts were loud. They used common system identifiers and made little effort to hide. Noise is easy to see. Even so, the attacker had months of attempts to work with. The basics at the edge were not enforced.
The source does not say how long the bank took to notice. Every board can put that question to its own team. How long would noisy activity run before a person acts on it?
What the bank did, and a caveat
Unit 42 ran a threat hunt. Its team combed device-level records from thousands of computers. It also read logs from dozens of Windows and Linux servers. It found no further attacker presence. Bank leadership reviewed the exposed documentation and rotated all compromised credentials. The bank then added Cortex XSIAM and Cortex XDR licenses. It also widened its incident response retainer.
A caveat applies. Unit 42 is a vendor, and its account credits its own product for the containment. The case is also a single incident. It shows how one intrusion happened. It does not show how common this pattern is. Unit 42 points readers to its Global Incident Response Report for wider trends. That report draws on its work on over 750 real-world attacks.
Questions to put to your team
Start with the edge. Which gateways, VPNs and remote-access devices are run by outside providers? Does each one enforce strict authentication? Who checks? Unit 42 names two examples of oversight that opportunistic attackers use: missing multi-factor authentication on a VPN and an unpatched edge device.
Then look inside. Do repeated failed logins on administrator accounts raise an alert that a named person owns? Are the systems that push software to your whole estate watched more closely than ordinary servers? Unit 42 names two defenses: strict identity access controls, and endpoint detection to stop lateral movement.
A weak attacker can still do harm when the basics are missing. The question for leaders is who owns those basics when they are left to someone else.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Palo Alto Networks Unit 42.
