UNIT 42’s September 2026 threat intelligence roundup highlights five top initial access vectors that adversaries relied on to breach organisations. The report identifies exploitation of public-facing applications as the primary entry mechanism, with clusters targeting exposed internet-facing web apps, database instances and perimeter services to establish footholds.
It also notes credential abuse as a leading secondary vector, where attackers use pre-harvested or illicitly obtained credentials, often in combination with edge-service vulnerabilities to bypass defences and blend in with legitimate users. Social engineering remains a key enabling tactic, with phishing and targeted manipulation driving credential compromise and payload delivery across public sector, defence and regional enterprises.
Beyond these, the study points to high-impact systemic risks from supply chain compromise and specialised drive-by compromises (watering hole attacks). Supply chain intrusions are described as producing cascading effects across diverse critical infrastructure sectors, reflecting advanced attacker tradecraft and trusted-relationship exploitation.
Drive-by/watering hole techniques are depicted as automated exploitation that can trigger system compromise simply when a target visits a compromised site, with instances observed in select operational campaigns. The article frames these vectors as interconnected threats tied to external edge exposure and identity-related weaknesses, underscoring the need for robust public-facing asset hardening, credential hygiene and vigilant monitoring of supply chains.
The findings come from Unit 42 Threat Intelligence for September 2026 and are intended to help security teams prioritise real-world risks and detection efforts.