Missing MFA and Weak Third-Party Controls Open Door to European Bank Intrusion

A European bank suffered a prolonged cyber intrusion after attackers exploited weak authentication controls on a third-party-managed external gateway.

The incident involved unauthorized Virtual Private Network (VPN) access, repeated password-guessing attempts, internal network scanning, and attempts to execute malicious code on a central management server.

According to an investigation by Palo Alto Networks’ Unit 42, the attack continued for several months before the bank detected suspicious activity across its central IT infrastructure.

The incident highlights how missing multi-factor authentication (MFA), weak third-party security, and inadequate access controls can expose critical financial systems to cyber threats.

Although the attacker demonstrated persistence, the investigation found that the intrusion relied mainly on basic security weaknesses rather than advanced attack techniques.

Bank Breach Exposes MFA Gaps

The investigation revealed that the intrusion began through a third-party-managed external gateway appliance that did not enforce strict authentication requirements. Using compromised credentials, the attacker gained access to internal systems and started exploring the bank’s network.

The threat actor performed extensive host and network scans across multiple protocols, interacting with thousands of systems. These activities appeared designed to identify additional systems, services, and potential entry points.

Over several months, the attacker also conducted repeated password-guessing campaigns against internal systems, particularly targeting administrator accounts. These brute-force attempts aimed to discover valid credentials and expand access to sensitive infrastructure.

The attacker also targeted internal documentation platforms and shared data resources. Automated web requests were used to collect individual pages and attachments, while operational and network shares were systematically enumerated.

The high volume of scanning and authentication attempts suggested that the attacker was not making strong efforts to remain undetected.

Instead, the activity appeared consistent with an opportunistic threat actor attempting to identify and compromise as many accessible systems as possible.

Despite the relatively unsophisticated approach, the prolonged activity created a serious risk because the attacker had access to internal resources and continued searching for opportunities to increase control.

In the final stage of the intrusion, the attacker attempted to exploit a remote code execution vulnerability in Windows Server Update Services (WSUS) on the bank’s central configuration management server.

The server was particularly sensitive because it supported software distribution across the organization. Successful exploitation could have provided an opportunity to execute unauthorized code, establish persistence, and potentially spread across the network.

However, Cortex XDR detected the suspicious execution attempt and contained the threat before the attacker could establish a persistent foothold or move laterally, unit42 said.

Unit 42 subsequently conducted a comprehensive forensic investigation, reviewing endpoint telemetry from thousands of systems and logs from dozens of Windows and Linux servers. Investigators found no additional attacker presence or persistent backdoors.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team