Attackers Exploit Gaps in MFA Coverage

Organizations may require multi-factor authentication (MFA) for cloud applications while leaving other systems accessible with passwords alone, creating gaps attackers can exploit, according to a BleepingComputer article written by Specops Software.

The article describes an August 4, 2026 incident in which an Akira ransomware affiliate tried passwords against a SonicWall SSL VPN. About seven minutes later, a login succeeded using valid credentials on an account without MFA. Roughly two hours later, the attacker used RDP to reach a domain controller and began exploring Active Directory. The ransomware deployment failed, but credentials and file-share data had already been stolen.

It cites Mandiant investigations in which compromised legitimate credentials provided initial access in 21% of 2025 incidents with an established entry point. RDP was used for lateral movement in around 85% of ransomware incidents investigated. Verizon’s Data Breach Investigation Report found stolen credentials involved in 44.7% of breaches.

The article says cloud MFA does not automatically protect VPNs, RDP, Windows logon, or older Active Directory-backed services that accept the same identity with only a password. It argues that organizations should identify where passwords still work alone and apply stronger authentication to those routes.

Specops promotes its Secure Access product for extending MFA to Windows logon, RDP, and VPNs, and says it supports SaaS single sign-on through OIDC and SAML. The article also describes Specops Password Auditor as a free, read-only tool for finding password-related vulnerabilities in Active Directory. These are the vendor’s product descriptions.