Not every serious intrusion starts with a nation-state exploit chain or custom malware. Sometimes the incident begins with a vendor access path, reused or compromised credentials, and basic controls that were not enforced consistently.

Unit 42 described an investigation at a European bank where unusual activity on central IT systems led defenders to months of unauthorized VPN-based access attempts. The case is useful because the attacker was noisy and relatively unsophisticated — but still reached internal systems through a third-party-managed external gateway that was not locked down tightly enough.

That is the part SMBs and government contractors should pay attention to. Third-party access is often treated as an operational convenience. In practice, it is a privileged perimeter extension. If that access lacks strong authentication, logging, patch discipline, and ownership, it can become the easiest way into the network.

What happened

According to Unit 42, the attacker used compromised credentials to authenticate through an externally reachable gateway appliance managed by a third party. Once inside, they launched broad internal reconnaissance across many hosts and protocols, interacted with thousands of systems, and tested credentials against internal services over a period of months.

The activity did not look like a quiet, highly tailored espionage operation. It looked noisy: scanning, password guessing, common system identifiers, automated requests against internal documentation, and enumeration of operational and network shares.

The attacker later attempted to exploit a Windows Server Update Services remote-code-execution path on a central configuration management server. That system mattered because software distribution infrastructure can become a powerful persistence and lateral-movement platform if compromised. In this case, endpoint detection identified the unauthorized code execution attempt and contained the activity before the attacker could establish a deeper foothold.

Why this matters

The lesson is not “buy one specific tool.” The lesson is that basic control failures compound quickly around third-party access.

A vendor gateway without strict authentication can turn into an unmanaged front door. Internal documentation and file shares can give an intruder a map of the environment. Password-guessing against administrator accounts can become a privilege-escalation path. A configuration management server can become the launchpad for enterprise-wide compromise.

For government contractors, the risk is sharper because vendor access, remote support, managed service providers, and customer-connected environments often sit near sensitive data, regulated systems, or CUI-handling workflows. A “simple” intrusion can still become a reportable incident if it touches the wrong enclave or exposes the wrong evidence trail.

Defensive takeaways

  • Inventory every vendor access path. Track who owns it, what it reaches, how authentication is enforced, and whether logs leave the appliance.
  • Require MFA for third-party remote access. Exceptions should be rare, time-bound, and approved as risk decisions.
  • Centralize gateway, VPN, and identity logs. If the first useful logs are on the compromised device, defenders are already behind.
  • Segment vendor access. Third parties should land in controlled zones with explicit access to required systems only, not broad internal reach.
  • Watch for noisy reconnaissance. Internal scanning, share enumeration, web scraping of documentation portals, and password spraying should trip early alerts.
  • Treat software distribution and RMM systems as Tier 0/1 assets. WSUS, configuration management, backup, identity, and RMM infrastructure need stronger monitoring than ordinary servers.
  • Rotate credentials after gateway exposure. Do not assume containment is complete until vendor, admin, service, and cached credentials have been reviewed.

Questions leadership should ask

  • Which third parties can remotely access our network today?
  • Can any vendor access path bypass MFA?
  • Do we know which internal systems each vendor can reach?
  • Would we detect internal scanning from a VPN user within minutes, hours, or weeks?
  • Are configuration management servers monitored like crown-jewel infrastructure?

Bulwark Black assessment

This case is valuable because it strips away the mystique. The attacker did not need elite tradecraft to create risk. They needed a weak access path, valid credentials, internal visibility, and enough time to keep trying.

For small teams, the practical answer is disciplined access governance: know every remote-access path, enforce MFA, reduce vendor blast radius, export logs, and alert on noisy internal behavior. Those controls are not glamorous, but they are exactly what keeps a sloppy intrusion from turning into a full business outage.

Source: Unit 42 — The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk.