Customer story
A regional IT services provider exposed its ServiceDesk login without rate limits. Unit6 spotted the shift from brute-force to successful use, shut it down, and rebuilt access controls.
The situation
An internet-facing ServiceDesk login with shared password patterns drew a burst of authentication attempts. Watcher Network telemetry showed the moment attackers moved from guessing to authenticated exploration.
What Unit6 detected
Why it mattered
What Unit6 did
Immediate containment
Compromise assessment
Authentication and access control uplift
Threat hunting and follow-on defenses
Outcome
Unit6 edge
Browse other stories
Stopping a nation-state from reaching industrial OT via a SaaS monitoring platform
An East Asia-aligned actor used stolen credentials to access an OT monitoring SaaS. Unit6 cut the access path and rebuilt controls before the adversary could reach production lines.
Preventing ransomware by catching an MFA bypass against a healthcare claims portal
A ransomware-linked actor marketed access to a children’s hospital claims portal, including the MFA secret. Unit6 shut down the identity and drove phishing-resistant controls before patient data was touched.
Exposing a multi-actor campaign against HR, payroll, and internal portals
Multiple actor clusters targeted an outsourcing firm’s kiosk, HR, and payroll surfaces simultaneously. Unit6 treated it as one campaign, closing credential abuse and hardening exposed services quickly.
Catching a nation-state’s brute-force campaign against a global satellite operator
A Chinese-directed cluster brute-forced internal support portals for a satellite operator and took over accounts. Unit6 surfaced the compromise and rebuilt authentication before operations were touched.
Detecting AI-powered brute forcing against a fintech customer portal
AI-augmented actors brute-forced and sprayed a payments portal, taking over customer accounts. Unit6 cut off access, drove mandatory MFA, and hardened defenses against adaptive attacks.
Early warning on initial access broker claims against aviation messaging systems
Unit6 spotted a broker selling access to an aviation messaging platform before abuse began. Accounts and endpoints were hardened and a rapid-response plan put in place.
Disrupting state-sponsored recon and credential exposure against a high-precision manufacturer
State-linked actors targeted engineers and admin portals at a medtech/optics manufacturer. Unit6 neutralized exposed credentials and hardened privileged access before exploitation.
Dual nation-state intrusion into a critical file transfer system — detected before impact
Two unrelated nation-state actors exploited the same secure file transfer stack simultaneously. Unit6 surfaced both compromises and stopped large-scale exfiltration before internal teams saw anomalies.
Supply-chain ransomware campaign leveraging a compromised SaaS administrator — multi-tenant threat stopped early
A ransomware group weaponized trusted admin pathways inside a business intelligence SaaS. Unit6 saw the compromise, coordinated fast revocation, and blocked cross-customer propagation.
Supply-chain intrusion into a global pharmaceutical enterprise — pre-ransomware phase blocked
A Sophisticated Threat Actor attempted to pivot from a compromised SaaS provider into a pharmaceutical company via trusted admin links. Unit6 severed trust and stopped the intrusion in the staging phase.