Attackers Breach European Bank Through Third-Party Gateway and Target WSUS Server

A European bank was breached through a poorly secured, third-party gateway before an attacker tried to exploit its Windows Server Update Services (WSUS) infrastructure. The case shows how stolen login details and weak access controls can put a bank’s central software systems at risk without a complex attack chain. The bank’s security team uncovered unauthorized VPN access attempts stretching across several months after spotting unusual activity on its central IT system. Investigators traced the intrusion to an external gateway managed by a third party, where strict authentication had not been properly enforced. Researchers from Unit 42 identified the intrusion and its attempted code execution, but their report does not...

Read the full article at the source.