As reported by BleepingComputer, an Akira ransomware affiliate recently compromised a SonicWall SSL VPN account protected only by a password — no MFA in place. Within roughly two hours, the attacker reached the domain controller via RDP, enumerated Active Directory, and exfiltrated data before the ransomware deployment ultimately failed. The incident underscores a persistent and dangerous asymmetry: organizations investing heavily in MFA for SaaS and cloud platforms while leaving legacy remote access paths exposed.

Ransomware Alert: As reported by BleepingComputer, an Akira ransomware affiliate recently compromised a SonicWall SSL VPN account protected only by a password — no MFA in place.

The Authentication Blind Spot

The core issue isn't that MFA doesn't work — it's that partial MFA deployment creates exploitable seams. Security teams secure Microsoft 365, Salesforce, and other cloud apps with strong authentication, then leave SSL VPN concentrators, RDP gateways, SSH jump hosts, and on-premises web applications relying on passwords alone. Attackers don't need to defeat MFA; they simply find the access path where it isn't enforced.

This is not a fringe problem. Mandiant's 2025 incident data, cited in the BleepingComputer piece, shows compromised credentials accounted for initial access in 21% of ransomware cases where the entry point could be determined. RDP appeared in roughly 85% of those incidents for lateral movement. These are not sophisticated zero-days — they're basic credential attacks against unprotected entry points.

Why This Matters Now

AI-assisted credential spraying is lowering the cost and raising the speed of these attacks. The seven-minute window between the start of password spraying and successful authentication in the Akira incident illustrates how quickly attackers can find a valid credential when password policies are weak and MFA is absent. As AI tooling makes password spraying and credential reuse checks faster and more scalable, every password-only access path becomes a liability that compounds over time.

The threat isn't a new attack technique — it's the acceleration of familiar techniques. Credential theft, password spraying, and RDP lateral movement are well-understood. What's changed is the operational tempo attackers can sustain.

Who Is Most at Risk

Why This Matters Now
Mid-size enterprises with hybrid environments where cloud apps have MFA but on-prem infrastructure does not
Organizations with legacy VPN concentrators (SonicWall, Fortinet, Cisco AnyConnect) that support MFA but where it was never enabled or was disabled for convenience
Environments with broad RDP exposure — either internet-facing or reachable through compromised VPN credentials
Active Directory-dependent shops with weak password policies and no continuous credential exposure monitoring

Shield53 Recommendations

Defenders should treat authentication coverage as a perimeter problem — not a SaaS problem. Partial coverage is not a reduced risk; it's a directed attack surface.

Immediate Actions

  • Inventory every external authentication endpoint. Map every VPN, RDP gateway, web portal, and remote access tool. For each, document whether MFA is enforced — not merely available.
  • Enforce MFA on all remote access paths. This includes SSL VPN, IPSec VPN, RDP gateways, SSH bastions, and any on-prem web application exposed externally. If a vendor supports MFA, there is no defensible reason it should be disabled.
  • Audit Active Directory for exposed credentials. Run continuous password exposure checks against known breach corpora. Tools like Specops Password Auditor (mentioned in the source) or HaveIBeenPwned API integrations can identify accounts using previously breached passwords.
  • Restrict RDP at the network level. RDP should never be internet-facing. Limit RDP to specific jump hosts behind VPN with MFA, and use Just-in-Time access patterns where possible.
  • Deploy conditional access policies. Require MFA based on sign-in risk, location, device compliance, and application sensitivity — not just blanket policies that miss edge cases.
  • Monitor for credential spraying patterns. Alert on rapid sequential authentication failures across multiple accounts from a single IP, and on successful authentication immediately following a spray pattern.

Strategic Actions

  • Adopt a passwordless roadmap. Phishing-resistant authentication (FIDO2, passkeys) eliminates the credential theft vector entirely. Prioritize administrative accounts first.
  • Implement continuous credential exposure monitoring rather than periodic audits. Breach databases are updated constantly; your detection should be too.
  • Segment lateral movement paths. Even if initial access succeeds, RDP-based lateral movement should be constrained by network segmentation and privileged access management.

The Akira incident described by BleepingComputer ended without encryption — but data was still stolen. In 2026, a failed ransomware deployment is still a successful breach. The lesson is straightforward: authenticate everything, or accept that attackers will find what you didn't.