Multi-factor authentication has become standard for Microsoft 365 and other cloud apps, but a real-world Akira ransomware attack from August 2026 shows how MFA security gaps elsewhere in a network can still let attackers walk right in. In that incident, a ransomware affiliate sprayed passwords against a SonicWall SSL VPN account that had no MFA protecting it, got in within about seven minutes, and used RDP to reach the domain controller roughly two hours later. The ransomware deployment itself failed, but the attacker still managed to steal credentials and file-share data before being stopped.
Why MFA security gaps keep showing up in VPN and RDP access
The core problem is that MFA protection often doesn’t travel with the user identity across every system. A company might require extra verification to log into Microsoft 365 through its identity provider, but the same username and password could still work, unprotected, on a VPN, a Windows logon, or an older Active Directory-backed service. That inconsistency is exactly what gave the Akira affiliate its opening. Mandiant’s 2025 ransomware investigations back this up: compromised legitimate credentials were the entry point in 21% of cases with an identifiable access method, usually through RDP or VPN, and attackers used compromised or newly created accounts over RDP to move around the network in about 85% of ransomware incidents reviewed. Verizon’s Data Breach Investigations Report found stolen credentials play a role in 44.7% of all breaches, underscoring why password reuse and weak credentials remain such a reliable foothold for attackers. This kind of credential abuse isn’t limited to VPNs, either; as NovaCookies Phishing Toolkit Exploits DocuSign to Hijack Microsoft 365 Sessions showed, attackers are also finding creative ways to hijack sessions even when some protections are in place.
Closing the gap with auditing and broader MFA coverage
Tools like Specops Password Auditor, a free, read-only scanner, can help IT teams spot weak or compromised passwords in Active Directory before attackers do. For stronger coverage, Specops Secure Access extends MFA to Windows logon, RDP, and VPN authentication, and supports single sign-on for SaaS apps through OIDC and SAML, while feeding authentication activity into SIEM and SOC tools for monitoring. The lesson lines up with other recent security findings, including CISA Warns of Critical Gitea Vulnerability Exploited in Code Injection Attacks, which also highlights how attackers exploit whatever access path is left weakest. The practical takeaway for any IT team: ask where a password alone is still enough to get in, and close that door before someone else finds it first.
المصدر: BleepingComputer
