Cybercriminals are continuing to exploit gaps in multi-factor authentication (MFA) to break into corporate networks, steal sensitive information and prepare ransomware attacks, highlighting a major weakness in organisations’ cybersecurity defences.
A cybersecurity report published on October 13, 2026, detailed an August incident in which an affiliate of the Akira ransomware group targeted a SonicWall SSL virtual private network (VPN) using a password-spraying attack.
According to the report, the attacker began attempting different login combinations on August 4, 2026. Within approximately seven minutes, one attempt succeeded because the account had valid credentials and was not protected by multi-factor authentication.
About two hours later, the attacker used Remote Desktop Protocol (RDP) to access the organisation’s domain controller and began examining its Active Directory environment.
Although the ransomware deployment ultimately failed, the attacker had already stolen credentials and obtained file-sharing data.
The incident illustrates how hackers can exploit weaknesses in authentication systems even when organisations have introduced stronger security measures for cloud applications.
Multi-factor authentication is designed to provide an additional layer of protection by requiring users to verify their identity through more than just a password.
However, cybersecurity specialists warn that MFA protection is not always applied consistently across an organisation’s entire technology infrastructure.
A company may require MFA for Microsoft 365 and other cloud services while leaving VPN connections, Windows logins, RDP sessions and older business applications accessible through passwords alone.
This creates opportunities for attackers who obtain legitimate login credentials.
In the reported Akira ransomware incident, the attacker exploited an account that lacked MFA protection, gaining an initial foothold in the organisation’s network.
Once inside, cybercriminals can attempt to access additional systems, escalate privileges, move between devices and search for sensitive information.
The incident demonstrates why organisations must examine every authentication route rather than assume that deploying MFA for selected applications provides complete protection.
Compromised credentials remain an important entry point for ransomware operators and other cybercriminals.
Attackers can obtain passwords through phishing, previous data breaches, password reuse and automated password-spraying campaigns.
Password spraying involves attempting a small number of commonly used passwords against multiple accounts, helping attackers avoid some of the detection mechanisms triggered by repeated attempts against a single account.
According to findings from Mandiant’s ransomware investigations cited in the report, compromised legitimate credentials accounted for initial access in 21 per cent of investigated incidents in 2025 where the entry point could be established.
The report also noted that RDP frequently featured later in ransomware attacks, with compromised or newly created accounts used for lateral movement in approximately 85 per cent of the ransomware incidents investigated.
These findings underline the importance of securing remote access systems, monitoring account activity and limiting the privileges assigned to user accounts.
Artificial intelligence is adding another dimension to the cybersecurity challenge by helping attackers automate and scale familiar techniques.
Rather than replacing established attack methods entirely, AI can make activities such as reconnaissance, account targeting and the processing of stolen information faster and easier to conduct at scale.
The fundamental tactics remain familiar: compromise credentials, exploit legitimate access, escalate privileges and move through vulnerable networks.
For businesses, this means traditional security measures remain essential even as the tools used by attackers become more sophisticated.
Organisations must combine strong authentication with continuous monitoring, secure password policies and effective incident-response procedures.
One of the most significant risks is the assumption that enabling MFA for cloud services automatically secures every system connected to the same corporate identity.
In practice, different applications and infrastructure components may use different authentication arrangements.
For example, an employee might need a second authentication factor to access a cloud application but be able to connect to a corporate VPN using only a password.
Similarly, remote desktop connections and older Active Directory-backed services may remain vulnerable if additional authentication requirements have not been implemented.
Cybersecurity teams should therefore identify every system that accepts corporate credentials and determine whether passwords alone are sufficient to gain access.
Particular attention should be given to VPN services, RDP, Windows logins, administrator accounts and legacy applications.
Security specialists recommend a comprehensive approach to identity protection rather than relying on a single cybersecurity product.
Key measures include:
- Enforce MFA consistently: Extend multi-factor authentication to remote access, Windows logins and other systems where technically appropriate.
- Audit passwords regularly: Identify weak, reused or compromised passwords and enforce stronger password policies.
- Secure privileged accounts: Restrict administrator access and apply additional safeguards to accounts with elevated permissions.
- Monitor suspicious logins: Investigate unusual authentication attempts, repeated failures and unexpected remote access.
- Limit account privileges: Ensure users and service accounts have only the access required for their responsibilities.
- Review legacy systems: Identify older applications and infrastructure that may bypass modern authentication controls.
- Prepare for ransomware incidents: Maintain tested backups, response procedures and systems for detecting unauthorised activity.
Tools that audit Active Directory password security can help organisations identify weaknesses before attackers exploit them. However, password auditing should complement, rather than replace, MFA and other access controls.
The October report was sponsored by Specops Software, a company that provides password security and authentication products.
The report highlighted Specops Password Auditor as a tool for identifying password-related vulnerabilities in Active Directory environments. It also promoted Specops Secure Access, which is designed to extend multi-factor authentication to Windows logins, RDP and VPN access.
These products are commercial offerings promoted by the sponsor; organisations should evaluate them alongside other solutions based on their infrastructure, security requirements and budgets.
More broadly, the incident reinforces an important cybersecurity principle: protecting cloud applications alone is not enough if other routes into the corporate network remain vulnerable.
The failed ransomware deployment in the reported Akira incident did not prevent the attacker from stealing credentials and file-share data.
That distinction is important because an unsuccessful ransomware attack does not necessarily mean an organisation escaped a security breach or avoided data loss.
Businesses must therefore focus on preventing unauthorised access, detecting intrusions early and restricting what attackers can do after compromising an account.
As cybercriminals continue to exploit exposed remote access services and weak authentication arrangements, closing MFA security gaps has become an essential part of protecting corporate networks.
The central lesson for organisations is straightforward: if a password can still provide access to critical systems on its own, that access route may remain an attractive target for cybercriminals.
