Key points
- Edge exploitation was the most frequent initial access method observed in September 2026.
- Credential abuse and phishing campaigns targeted public sector and critical infrastructure.
- Supply chain intrusions and drive-by compromises posed significant systemic risks.
Adversaries relied heavily on exploiting external edge infrastructure and compromising user identities to breach organizations in September 2026, according to Palo Alto Networks Unit 42. The threat intelligence team identified these two vectors as the primary footholds for intrusion campaigns, with attackers targeting public-facing web applications and database instances to establish persistent access.
Unit 42 observed that threat clusters frequently chained credential abuse with edge-service vulnerabilities to bypass perimeter defenses. This combination allowed attackers to blend their malicious activity with legitimate user behavior, making detection more difficult. The report highlights that these methods were the most common entry points during the reporting period.
What we know
Social engineering remained a primary delivery mechanism for targeted operations against public sector, defense, and regional enterprise environments. Attackers used electronic messaging and browser-centric lures to compromise credentials and execute payloads. These campaigns were specifically designed to exploit human trust and procedural gaps within high-value targets.
Supply chain intrusions emerged as a specialized, high-consequence vector. Unit 42 noted that these attacks produced widespread cascading impacts across diverse critical industry sectors. The exploitation of trusted relationships and advanced attacker tradecraft amplified the severity of these breaches, affecting interconnected technology ecosystems beyond the initial compromise point.
Zero-interaction drive-by compromises also posed acute systemic risks. In these scenarios, target traffic directed to compromised or malicious web destinations triggered system compromise without requiring any interaction beyond site visitation. This automated exploitation technique was observed across select specialized threat operations, highlighting the danger of passive exposure to malicious web content.
Defender's checklist
- Audit internet-facing web applications and database instances for known vulnerabilities.
- Monitor for anomalous authentication patterns that may indicate credential spraying.
- Review supply chain dependencies for signs of unauthorized code modifications.
- Implement strict access controls for public-facing perimeter services.
What analysts watch for
Security teams usually examine network logs for unusual traffic patterns originating from public-facing services. Analysts check whether authentication events show signs of credential stuffing or spraying attacks. They also review web server logs for exploitation attempts against known vulnerabilities. Teams typically inspect email gateways for phishing lures targeting sensitive sectors.
Monitoring for zero-interaction exploits involves analyzing browser behavior and script execution on visited sites. Investigators look for indicators of compromise in supply chain components. They assess whether lateral movement occurred after initial access. Reviewing firewall logs helps identify unauthorized connections to external command and control servers.
Background: Command and control servers
A command and control server is a remote system that directs malware installed on a victim’s machine. It receives stolen data and sends instructions for further actions. This architecture separates the attacker from the target, enabling persistent access and coordinated attacks across multiple compromised systems.
Read the full guide: Command and Control Servers: How Malware Maintains Remote Access
What to do and how to stay safe: Unit 42
- Inventory all internet-facing services and ensure they are patched to the latest versions.
- Enforce multi-factor authentication to mitigate the risk of credential abuse.
- Monitor user accounts for suspicious login attempts from unfamiliar locations.
- Review supply chain integrity by verifying software signatures and updates.
Step-by-step guide: Threat Intelligence Program Checklist for Secure Operations
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What were the top initial access vectors in September 2026?
Unit 42 identified edge exploitation and credential abuse as the top vectors, followed by phishing, supply chain intrusions, and drive-by compromises.
Which sectors were primarily targeted by phishing campaigns?
Phishing campaigns predominantly targeted public sector, defense, and regional enterprise environments.
How do drive-by compromises work?
These compromises occur when traffic directed to malicious web destinations triggers system compromise without requiring user interaction beyond visiting the site.
