European Bank Breached Through Third-Party Gateway

A European bank was breached through a third-party gateway with insufficient security measures, putting its central systems at risk. Attackers exploited weak authentication protocols to gain unauthorized VPN access, allowing them to target the bank’s Windows Server Update Services (WSUS) infrastructure. Unit 42’s investigation, published on October 13, 2026, revealed compromised credentials as the entry point, not a new software exploit. Once inside, the intruder conducted broad network scans and attempted password-guessing campaigns, targeting administrator accounts to expand access. The attacker also executed automated web requests to scrape internal pages, though no customer banking records were confirmed stolen. They aimed to exploit a remote code execution vulnerability on the WSUS server, a move thwarted by Cortex XDR. This incident underscores the importance of robust identity controls, timely patching, and thorough endpoint monitoring. Security teams should prioritize these measures to safeguard against similar threats. For more information, visit the official news article at:

Attackers Breach European Bank Through Third-Party Gateway and Target WSUS Server