Exposed Systems and Stolen Logins Lead the Way Into Networks, Says Unit 42

Unit 42 Threat Intelligence has published its overview of the top five initial access vectors seen in September 2026. The report points to a strong reliance on attacks against systems exposed to the internet and on the abuse of legitimate logins, which together gave attackers their main footholds.

The most common entry method was exploitation of public-facing applications. Multiple threat groups found and compromised exposed web applications, database instances and other perimeter services to gain a lasting presence. The second most prevalent vector was valid credentials. Attackers used stolen, sprayed or otherwise obtained login details, often alongside weaknesses in edge services, which let them bypass perimeter defences and blend in with normal user activity.

Phishing and targeted social engineering ranked third. These lures, delivered by messaging and through web browsers, were used to steal credentials and run malicious payloads, mainly against public sector, defence and regional enterprise targets. The remaining two vectors were more specialised. Supply chain compromise can cause widespread, cascading impact across industries by exploiting trusted relationships. Drive-by compromise, including watering hole attacks, can infect systems simply because someone visits a compromised or malicious website. Unit 42 observed it in select specialised operations.