Simple Oversights, Serious Breach: How a Poorly Configured Third-Party Gateway Let Attackers Into a European Bank

A European bank's security team spotted unusual activity on its central IT system and acted quickly. They found unauthorised VPN-based access attempts spanning several months, then brought in Unit 42 to establish the full scope of the intrusion, look for persistent footholds and secure the environment.

Although the activity looked like stealthy cyberespionage, Unit 42 found the intrusion succeeded because of gaps in basic security controls rather than novel techniques. The entry point was an external gateway appliance managed by a third party and not properly configured to enforce strict authentication. Using compromised credentials, the attacker logged in to internal systems and began exploring the network.

The attacker ran multiple rounds of scanning across many protocols, touching thousands of systems. Over a few months they also launched repeated password-guessing campaigns, focusing on administrator accounts. They scraped internal documentation and attachments using automated web requests, and mapped operational and network shares.

Unit 42 assessed that the behaviour did not match a sophisticated actor. The noisy scanning, the login attempts and the use of common system identifiers suggested an opportunistic attacker trying many systems, with little effort to avoid detection. The lesson: stronger identity protections and basic security hygiene could have prevented the intrusion. Note that this article covers only the opening of the original report.