Attackers Exploit MFA Gaps in VPN, RDP and Windows Access
Summary
A ransomware intrusion described in the article exploited a VPN account without MFA. The sponsored article urges organizations to audit password risks and extend MFA beyond cloud applications to VPN, RDP and Windows access.
Key points
- The article describes an Akira affiliate using password spraying to access a SonicWall SSL VPN account that lacked MFA; the ransomware deployment failed, but credentials and file-share data were stolen.
- The attacker reportedly reached a domain controller via RDP about two hours after gaining VPN access.
- Mandiant data cited in the article says compromised credentials enabled initial access in 21% of 2025 ransomware incidents with an established entry point; RDP was used for lateral movement in around 85% of investigated incidents.
- Cloud MFA does not necessarily protect other systems that accept the same identity with only a password, including VPNs, RDP, Windows logon and older Active Directory-backed services.
- The article recommends auditing weak, reused or previously exposed passwords and identifying every access path where a password alone is sufficient.
- It promotes Specops products for password auditing and extending MFA to Windows logon, RDP and VPN authentication.
Article Details
- Defense Focus
- Find and close authentication paths where a password alone grants access, while monitoring authentication activity and auditing password risk.
- Detection Methods
- Audit Active Directory for password weaknesses, reuse, and credentials exposed in previous breaches.
- Review where MFA is enforced across Windows logon, RDP, VPN access, and older AD-backed services.
- Feed authentication events and suspicious activity into broader monitoring.
- Data Sources
- Active Directory user and password-policy information
- Authentication events and suspicious activity
- Platforms
- Active Directory
- SIEM, SOC, and analytics platforms
- Defensive Actions
- Extend MFA to Windows logon, RDP, and VPN authentication.
- Regularly audit password-related vulnerabilities and address identified weaknesses.
- Review all authentication paths to identify systems where a password is sufficient on its own.
- Monitor authentication events and suspicious activity through existing security operations platforms.
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe attacker used RDP to access the domain controller and later used RDP for movement, as described in the article.T1078 · Valid AccountsThe affiliate used valid credentials to access the VPN account, which did not have MFA enabled.T1110.003 · Password SprayingAn Akira ransomware affiliate sprayed passwords against a SonicWall SSL VPN; one attempt using valid credentials succeeded.
Threat Actors
Malware
Vendors
Products
Active DirectoryRoughly two hours later, the attacker used RDP to access the domain controller and began enumerating Active Directory.Microsoft 365 Apps for EnterpriseIt highlights an issue that is still common in 2026, where an organization might require MFA for Microsoft 365 and other SaaS applications while leaving certain access paths protected only by passwords.SonicWall SSL VPNOn August 4, 2026, an Akira ransomware affiliate began spraying passwords against a SonicWall SSL VPN.Specops Password AuditorSpecops Password Auditor is a free, read-only password auditing tool that scans Active Directory for password-related vulnerabilities and presents the findings in an interactive report covering user and password policySpecops Secure AccessThat is where solutions like Specops Secure Access fit by extending MFA to Windows logon, RDP and VPN authentication.