The MFA Gaps Attackers are Still Exploiting
Cybersecurity experts warn that attackers are increasingly exploiting gaps in multi-factor authentication (MFA) by targeting non-SaaS access points like VPNs and RDP. While organizations often secure cloud applications, legacy infrastructure remains vulnerable, with AI tools helping attackers scale these credential-based attacks.
Why it matters
This highlights a critical security blind spot where inconsistent MFA implementation allows ransomware affiliates to gain initial network access.
On August 4, 2026, an Akira ransomware affiliate began spraying passwords against a SonicWall SSL VPN . Around seven minutes later, one attempt succeeded. The credentials were valid, and the VPN account had no multi-factor authentication (MFA) protecting it. Roughly two hours later, the attacker used RDP to access the domain controller and began enumerating Active Directory.
The ransomware deployment ultimately failed, but by then the attacker had already stolen credentials and file-share data.
It highlights an issue that is still common in 2026, where an organization might require MFA for Microsoft 365 and other SaaS applications while leaving certain access paths protected only by passwords. It's this gap that attackers are regularly exploiting.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in