The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk

The report describes an attack on the central IT system of a European bank in which the intruder made unauthorized VPN access attempts over several months. Rather than novel techniques, the actor exploited weaknesses in foundational security controls, repeated brute-force attempts against administrator accounts, and finally attempted to exploit a remote code execution vulnerability in Windows Server Update Services (WSUS) on the central configuration server. The WSUS server handled software distribution across the organization, making it a target for privilege escalation and long-term persistence. The case shows that even unsophisticated attacks can succeed through persistence and weak identity controls.