MFA for Businesses: Benefits, Bypass Risks, and Implementation Options
Summary
A business-focused guide explains MFA’s security benefits, adoption challenges, common bypass methods, and options ranging from SMS codes to hardware tokens. It also describes incidents observed by Huntress analysts.
Key points
- MFA adds authentication factors beyond a password and can reduce unauthorized account access; the article attributes a claim that it blocks up to 99.2% of account compromise attacks to Microsoft.
- Cost, deployment complexity, and user friction can hinder adoption, particularly at smaller businesses.
- The article describes bypass methods including SIM swapping, help-desk social engineering, push bombing, and adversary-in-the-middle attacks that steal session tokens.
- Huntress reports observing an incident in which an actor attempted to disable Duo Security after gaining access, and says token-stealing attempts made up almost 6% of its ITDR events in 2024.
- The article recommends avoiding publicly exposed RDP where possible and enabling MFA on externally exposed services.
- SMS or email codes, authenticator apps, hardware tokens, and biometrics offer different trade-offs in security, cost, and ease of deployment.
Article Details
- Topic
- Business multi-factor authentication: benefits, adoption challenges, and methods attackers use to bypass it
MITRE ATT&CK
T1110.001 · Password GuessingBrute-force attacks against applications without MFA are described, including attacks targeting RDP.T1110.004 · Credential StuffingCredential stuffing is described as a method threat actors use against accounts without MFA.T1539 · Steal Web Session CookieThreat actors are described as stealing session tokens to bypass certain types of MFA.T1557.003 · DHCP SpoofingAdversary-in-the-Middle attacks use a transparent proxy to intercept login input while relaying authentication to the legitimate service.T1621 · Multi-Factor Authentication Request GenerationScattered Spider is described as using push bombing, spamming targets with MFA prompts until one is approved.
Threat Actors
Products
Azure ADWhile some MFA options like Microsoft 365 and Azure AD are available at no extra cost, other considerations like employee training, additional expert guidance for deployment, and ongoing support may introduce more costsDuo SecurityAfter initial access, the threat actor was seen executing the following command: cmd.exe /Q /c reg delete “HKLM\Software\Duo Security” 1> \Windows\Temp\gGutd1 2>&1 Microsoft 365 Apps for EnterpriseWhile some MFA options like Microsoft 365 and Azure AD are available at no extra cost, other considerations like employee training, additional expert guidance for deployment, and ongoing support may introduce more costsMicrosoft AuthenticatorThen there are app-based authenticators like Microsoft Authenticator.YubikeyThese are physical devices (like a Yubikey) that employees use to verify their identity.