A tight perimeter — and a live attack in progress

The challenge

A manufacturer wanted its small, heavily-firewalled internet-facing surface and identity exposure assessed.

How it unfolded

1. Mapped a genuinely tight, well-firewalled perimeter.
2. Found an internet-facing remote-access gateway running an out-of-support server OS as an AD authentication boundary.
3. Confirmed it leaked internal domain and host names via an NTLM challenge.
4. Detected an active external credential-stuffing campaign in progress against several cloud-mailbox accounts.
5. Confirmed breach-corpus passwords were present but already rotated (a defensive positive); handed over provider trace IDs for log correlation.
6. Found a B2B file-transfer listener still negotiating legacy weak ciphers without mutual TLS.

Impact

The company was one unpatched gateway, or one reused password, away from a foothold — and was already being probed while we tested.

Outcome

A prioritised remediation list (retire the end-of-life gateway, close the credential-stuffing exposure, add DMARC, mutual TLS and modern ciphers) plus actionable intelligence on an attack already underway.