An intruder entered a European bank through a third-party-managed gateway with weak authentication enforcement, then targeted its central Windows Server Update Services (WSUS) server after months of noisy internal activity. The attacker used compromised credentials, scanned thousands of systems and guessed administrator passwords before trying to exploit a WSUS remote-code-execution vulnerability. Endpoint detection blocked the attempted code execution.
In its October 13 incident account, Unit 42 reports that it responded for the bank and that its own Cortex XDR product stopped the attempted execution. The bank’s security team had already noticed unusual activity on the central IT system and traced unauthorized VPN access attempts across several months. That months-long trail crossed a vendor-managed entry point, internal authentication systems and documentation shares before the alert on the update server.
A vendor gateway admitted the intruder
The external gateway was managed by a third party and, in Unit 42’s account, was improperly configured to enforce strict authentication. Compromised credentials let the attacker authenticate to internal systems. The report discusses missing VPN multifactor authentication as a preventable class of oversight; it gives the gateway’s weak authentication enforcement as the entry condition in this case. Start by identifying which provider controls the gateway configuration and which internal systems that gateway account can reach.
Once inside, the intruder ran repeated, high-volume host and network scans across a broad set of protocols and touched thousands of systems. Password-guessing campaigns against administrator accounts continued over a few months. At the same time, automated web requests scraped individual pages and attachments from internal documentation and enumerated operational and network shares. Unit 42 describes an opportunistic actor using common system identifiers with little attempt to hide. The combination of prolonged gateway attempts and conspicuous internal discovery gives defenders more than a single endpoint alert to work from.
Update distribution became the target
The intruder eventually tried to exploit a WSUS remote-code-execution vulnerability on the bank’s central configuration management server. That machine handled software distribution, so attacker control there would have put a sensitive administrative service in reach. Microsoft’s WSUS deployment documentation explains the basic topology: an internal WSUS server synchronizes updates and serves clients, while larger installations can synchronize downstream servers from an upstream one. In a simple deployment, Microsoft lists client-facing HTTP and HTTPS on ports 8530 and 8531 by default. Use your actual topology to identify your WSUS distribution point, its management access and the clients or downstream servers it supplies.
Unit 42 says, “The moment they attempted to execute unauthorized code, Cortex XDR identified the activity and contained the threat before it could escalate.” Its investigators reviewed endpoint telemetry across thousands of systems and logs from dozens of Windows and Linux servers; they found no additional attacker presence or persistent backdoors in that review. The bank reviewed exposed documentation and rotated compromised credentials. Unit 42 also says the bank expanded its Cortex XDR and XSIAM deployments and incident-response retainer after the response. This is vendor incident research about a customer and the vendor’s own detection product.
Choose patches using the installed WSUS build and its matching Microsoft advisory; Unit 42 leaves the incident’s specific vulnerability unidentified. The blocked execution attempt still calls for investigation of the gateway and documentation exposure.
Follow the months before the alert
In gateway and identity logs, correlate third-party account access and VPN attempts over the full available months-long window with administrator password failures on internal systems. Compare those sessions with network scan bursts and web requests for documentation pages and attachments. Then examine the central WSUS host’s endpoint detections and server logs around the attempted execution. Keep the event sequence and account identifiers together: a WSUS alert alone can obscure the route that brought the intruder there.
Remove that route by enforcing strong authentication on the provider-managed gateway, rotating exposed credentials and restricting vendor accounts to the specific internal systems they need. Separate WSUS management access from the third-party gateway segment; permit the documented update-delivery traffic that clients and downstream servers require. Inventory the server’s installed updates against applicable Microsoft guidance. Unit 42’s response combined credential rotation with endpoint containment and broad telemetry review.
Test access to the update server
From a third-party gateway account with its intended permissions, verify that WSUS administration and other unneeded internal systems are inaccessible while approved update delivery still works. Confirm the gateway enforces the identity policy you expect and that the server is on the applicable patched build. If you have an incident trail like this bank’s, join gateway sessions, administrator login failures, documentation requests and WSUS endpoint detections before deciding which accounts and documents need recovery work.
The bank had months of noisy activity before the blocked execution. A gateway access test addresses the entry route; joining those older records helps bound the intruder’s reach.