AN investigation by Unit 42 recounts a European bank’s security incident that began with unauthorized VPN-based access attempts to its central IT system over several months. The intrusion stemmed from gaps in basic security controls rather than novel techniques: a third-party-managed external gateway appliance was not enforcing strict authentication, allowing an attacker using compromised credentials to begin internal reconnaissance and mass credential testing.
The intruder conducted high-volume host and network scans across many protocols, then carried out credential stuffing against administrator accounts and scraped internal documents and shares with automated web requests. The activity appeared opportunistic rather than the work of a highly skilled actor, characterised by noisy scanning and routine system identifiers rather than stealth.
The bank engaged Unit 42 after detecting the activity, and Cortex XDR played a crucial role in containment, preventing the attacker from gaining lateral movement or a persistent foothold. A deep threat-hunt across thousands of endpoints and dozens of Windows and Linux servers found no additional attacker presence or backdoors.
The bank subsequently rotated compromised credentials, cleaned exposed documentation, and expanded defensive measures with Cortex XSIAM and Cortex XDR licences, together with enhanced incident response support. The overall lesson emphasises the importance of foundational security hygiene—strict identity controls, timely patching, and endpoint-based detection—to stop even opportunistic intrusions from escalating.
The article notes that while the threat was not highly sophisticated, it demonstrates how simple oversights can enable significant breaches, and stresses swift containment coupled with thorough threat hunting as an effective defence. Published 13 October 2026.