MFA Gaps Leave Organizations Exposed to Credential Attacks

“On August 4, 2026, an Akira ransomware affiliate began spraying passwords against a SonicWall SSL VPN.” Seven minutes after the spray began, a single login attempt succeeded — an account that had no multi‑factor authentication protecting it. Two hours later the attacker reached the domain controller over RDP and began enumerating Active Directory. By the time defenders stopped the operation, the intruder had stolen credentials and file‑share data even though the ransomware deployment ultimately failed.

Akira’s August 4, 2026 attack on a SonicWall SSL VPN

The timeline reported in the incident is compact and instructive. The attacker performed a password spray against a SonicWall SSL VPN, achieved a successful password‑only login within minutes, and then leveraged RDP to reach an on‑premises domain controller about two hours later. The intruder’s actions then shifted into Active Directory enumeration. The immediate takeaways are procedural: a password‑only path into a network can convert a remote, internet‑facing failure into full visibility inside the Windows estate.

Stolen credentials remain a primary access vector

The August incident reinforced a persistent pattern: once attackers obtain valid credentials they use the same authentication mechanisms as legitimate users. The added twist in 2026 is AI, which the source notes makes these familiar identity tactics “cheaper and easier to run at scale,” increasing speed and volume of attacks without changing the underlying playbook.

• Mandiant’s ransomware investigations found compromised legitimate credentials were the initial access vector in 21% of 2025 incidents where the entry point could be established, typically via RDP or VPN.
• RDP played a large role later in attack chains: attackers used compromised or newly created accounts over RDP for lateral movement in about 85% of the ransomware incidents Mandiant investigated.
• Verizon’s Data Breach Investigation Report found stolen credentials involved in 44.7% of breaches.

Why cloud MFA alone does not secure the Windows estate

Organizations often add MFA to Microsoft 365 and other cloud services because those applications are internet‑facing and frequently targeted. But cloud MFA does not automatically extend to every system that uses the same identity. The account used to authenticate to a SaaS application through an identity provider may still be accepted elsewhere with just a password.

The consequence is a fragmented authentication landscape: Windows logon, RDP, VPN access and older Active Directory‑backed services can remain password‑only. The Akira example illustrates how a gap on a VPN — a single account without MFA — provided a route from the internet into domain‑level access.

Specops tools presented as remediation: Password Auditor and Secure Access

The source details two Specops offerings as ways to reduce credential risk. Specops Password Auditor is described as a free, read‑only tool that scans Active Directory for password‑related vulnerabilities and produces an interactive report covering user and password policy information — intended to help IT teams find password weaknesses and prevent reuse or reliance on compromised credentials.

Specops Secure Access is presented as a way to extend MFA beyond cloud apps to Windows logon, RDP and VPN authentication, and to provide single sign‑on for SaaS applications via OIDC and SAML. The product is said to integrate with SIEM, SOC and analytics platforms so authentication events and suspicious activity feed into wider monitoring. The marketing copy in the source also claims the ability to block “4+ billion compromised passwords.”

What this means for technologists, procurement leaders, and end users

• Technologists and security teams: Review where passwords remain sufficient for access — not just whether MFA exists for cloud apps. Include Windows logon, RDP, VPNs and legacy AD‑backed services in audits, and consider tools that bring MFA to those authentication paths.
• Procurement and risk teams: When evaluating identity products, check for coverage across on‑premises and cloud authentication paths, SSO support via OIDC/SAML, and integration with SIEM or SOC workflows so authentication telemetry can be monitored centrally.
• End users and administrators: Regular password auditing and remediation reduce the chance a reused or breached password can be turned into network access; protecting cloud apps is necessary but not sufficient if other access routes accept a password alone.

No single control will stop every intrusion, and MFA is not a silver bullet. The August 4 incident makes a narrower, concrete point: ask where a password is still enough. Until organizations close those routes — whether by extending MFA to RDP, VPN and Windows logon or by reducing the value of passwords through auditing and blocking known‑compromised credentials — one successful password‑only login can translate into credentials, data exfiltration and deep exploration of Active Directory.

https://www.bleepingcomputer.com/news/security/the-mfa-gaps-attackers-are-still-exploiting/