Opportunistic Intruder Abuses Third-Party-Managed VPN Gateway Without MFA to Probe European Bank; WSUS RCE Attempt Blocked by Cortex XDR
Unit 42 investigated a months-long intrusion against a European bank, which began with unauthorized VPN-based access through a third-party-managed external gateway appliance that did not enforce strict authentication. Using compromised credentials, the attacker ran noisy, high-volume internal reconnaissance and brute-force campaigns again…