# Attackers Breach European Bank Through Third-Party Gateway and Target WSUS Server

> An unnamed European bank was breached using compromised credentials against a poorly secured, third-party-managed gateway/VPN with no MFA enforced. The intruder scanned thousands of internal systems, guessed administrator passwords, scraped internal documentation and attempted code execution on the WSUS server; Cortex XDR detected and contained it, and no persistent backdoors or confirmed customer data theft were found.

- **Published:** 2026-10-14T08:47:11Z
- **Last reviewed:** 2026-10-14T08:47:11Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3485
- **ID:** TL-2026-3485
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** RESOLVED
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-59287

## Description

Palo Alto Networks Unit 42 published an incident-response case study on 2026-10-13 ("Noise Inside Network: Third-Party Risk"), covered by Cyber Security News on 2026-10-14, describing an intrusion into an unnamed European bank. Initial access was obtained with compromised credentials through an externally facing gateway appliance that was managed by a third party and had gaps in foundational security controls, including no multi-factor authentication on the VPN. Unauthorized VPN-based access attempts continued over several months.

Once inside, the actor made little effort to remain hidden. Unit 42 describes multiple rounds of broad, noisy network scanning across a wide range of protocols that touched thousands of internal systems, multiple password-guessing campaigns targeting administrator accounts on internal systems, enumeration of operational and network shares, and automated web scraping of internal documentation pages and their attachments.

The actor then attempted code execution against the Windows Server Update Services (WSUS) role on a central configuration-management server that handles enterprise software distribution, apparently to gain persistence and reach. Cortex XDR detected the unauthorized code-execution attempt and contained it before persistence or lateral movement was achieved. The WSUS vulnerability used was not disclosed and no CVE is assigned in the source; CVE-2025-59287 (unauthenticated WSUS deserialization RCE, CVSS 9.8, in CISA KEV since 2025-10-24) is a plausible but unconfirmed candidate and is therefore NOT listed in cve_list.

The investigation covered forensic review of thousands of endpoints and log analysis of dozens of Windows and Linux servers, and found no additional attacker presence or persistent backdoors. Remediation included rotating all compromised credentials, reviewing the exposed documentation, expanding Cortex XSIAM/XDR coverage and an expanded IR retainer. No IOCs (IPs, domains, hashes, tools) were published, no actor was attributed, and the gateway vendor was not named.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1133 External Remote Services
- T1078 Valid Accounts
- T1110 Brute Force
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1135 Network Share Discovery
- T1119 Automated Collection
- T1213 Data from Information Repositories
- T1110.001 Password Guessing

## Sources

- [Attackers Breach European Bank Through Third-Party Gateway and Target WSUS Server](https://cybersecuritynews.com/attackers-breach-european-bank/)
- [Unit 42: Noise Inside Network: Third-Party Risk](https://unit42.paloaltonetworks.com/noise-inside-network-third-party-risk/)
- [Unit 42: Microsoft WSUS CVE-2025-59287 exploitation analysis (related context, link to this incident unconfirmed)](https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2025-59287 context)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [NVD: CVE-2025-59287 (related context)](https://nvd.nist.gov/vuln/detail/CVE-2025-59287)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3485