It probably is. It's not some web api. These things are usually designed for someone to use a remote desktop type system and/or VPN to access a LAN only web app running on a windows 2008 VM on a 10 year old tower server running VMware 6 in the utility room. Maybe these days there is a cloud portal they can access that has metrics and stuff. I see no indication in the article that this some exposed web app/API webpage.
Often attacks like this involve first getting on the VPN (leaked creds, a n-day on a web-accessible endpoint, etc) then running wild on the internal services that everyone assumes are safe.
It probably is. It's not some web api. These things are usually designed for someone to use a remote desktop type system and/or VPN to access a LAN only web app running on a windows 2008 VM on a 10 year old tower server running VMware 6 in the utility room. Maybe these days there is a cloud portal they can access that has metrics and stuff. I see no indication in the article that this some exposed web app/API webpage.
Often attacks like this involve first getting on the VPN (leaked creds, a n-day on a web-accessible endpoint, etc) then running wild on the internal services that everyone assumes are safe.
"I won't lock the door coz attackers might be able to bring battering ram"
you can just walk into any store, find ANY PC and stick your USB drive into it.
or find any exposed Ethernet slot and slide your device in it.
most of the time it will work and you will get an inside access.
publicly available retail stores require multiple layers of defense across the L7 stack