Threat reportThreat IntelligenceTL-2026-3429
MFA Coverage Gaps (Cloud-only MFA, VPN, RDP, Windows Logon) Exploited with Stolen Credentials - Akira Affiliate SonicWall VPN Intrusion (Aug 2026)
MFA Coverage Gaps (Cloud-only MFA, VPN, RDP, Windows Logon) (TL-2026-3429), also tracked as MFA coverage gap, is a medium-severity tracked intrusion set, first published 2026-10-13. It is attributed to Akira ransomware affiliate with medium confidence, affects SonicWall SSL VPN (accounts without MFA), maps to 10 MITRE ATT&CK techniques (T1021.001, T1039, T1078), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 10MITRE ATT&CK
- Actors
- 1Akira ransomware affiliate
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-3429
- Threat ID
- TL-2026-3429
- Also known as
- MFA coverage gap, Password-only VPN/RDP intrusion
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- Akira ransomware affiliate
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- education, finance, manufacturing, health
- Target regions
- North America, Europe, australia
- Detection rules
- 9
- Indicators of compromise
- 11
Malware and tooling in MFA Coverage Gaps (Cloud-only MFA, VPN, RDP, Windows Logon)
Malware and tooling: Akira, AnyDesk, AnyDesk, WinRAR, s5cmd
How MFA Coverage Gaps (Cloud-only MFA, VPN, RDP, Windows Logon) works
MFA is often enforced only on cloud/SaaS apps while VPN, RDP and Windows logon accept password-only authentication, and ransomware affiliates exploit that gap with stolen or sprayed credentials. On 2026-08-04 an Akira affiliate logged in to an exposed SonicWall SSL VPN account with no MFA and reached a domain controller over RDP about two hours later.
This item is a control-gap threat rather than a new vulnerability: no CVE is involved. A sponsored BleepingComputer article (Specops Software, published 2026-10-13) argues that organizations deploy MFA on cloud and SaaS applications (for example Microsoft 365) but leave on-premises and remote-access paths protected by passwords alone: VPN gateways, RDP, Windows interactive logon and legacy Active Directory-backed services. Attackers use stolen, reused or sprayed credentials to enter through whichever path lacks a second factor. The article is sponsored content and promotes Specops products, so the statistics below are secondary citations.
Statistics cited by the article: stolen credentials are involved in 44.7% of breaches (Verizon DBIR); compromised credentials were the initial access vector in 21% of 2025 ransomware incidents, and compromised or newly created accounts were used over RDP for lateral movement in about 85% of ransomware incidents (Mandiant / Google Cloud Threat Intelligence ransomware TTP analysis). Google's M-Trends 2026 also reports that compromised credentials accounted for 21% of ransomware intrusions, gathered through infostealer logs or purchased on underground forums.
The case study is an Akira ransomware affiliate intrusion on 2026-08-04, documented by Huntress and reported by BleepingComputer on 2026-08-13. Initial access was an exposed SonicWall SSL VPN account that had no MFA. The attacker made several failed logins, and the article reports about seven minutes to valid credentials via password spraying. About two hours after the successful VPN login the attacker connected over RDP to a domain controller, enumerated Active Directory users and computers, and moved to an application server. The attacker used WinRAR to archive mapped file shares and s5cmd to upload the data to an attacker-controlled S3 bucket. The attacker installed AnyDesk as a persistent remote channel and staged the akira.exe payload. The attacker forced a reboot into Safe Mode with Networking through msconfig.exe so that EDR services and Defender real-time protection would not start. This was the first time Huntress had seen Akira use that evasion. Encryption failed because of insufficient virtual memory in Safe Mode, and Defender quarantined the executable after the host returned to normal mode. The whole intrusion lasted under five hours, and credentials and file-share data were still stolen for extortion.
Broader Akira context from the CISA/FBI #StopRansomware advisory AA24-109A (updated 2025-11-13): Akira affiliates favor VPN services lacking MFA, exploit CVE-2024-40766 against SonicWall devices, and use credentials possibly obtained from access brokers. A 2025 campaign against SonicWall SSL VPNs also reportedly involved MFA bypass, via compromised OTP seeds or an undetermined zero-day. Defenders should enforce phishing-resistant MFA on every remote-access and logon path, audit Active Directory for weak and breached passwords, alert on password spraying against VPN gateways, and monitor for new RDP sessions to domain controllers, bulk archiving, S3 uploads and unsanctioned remote-access tools.
MITRE ATT&CK techniques used in TL-2026-3429
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol
Collection
T1039 Data from Network Shared Drive; T1560.001 Archive Collected Data: Archive via Utility
Initial Access
T1078 Valid Accounts; T1133 External Remote Services
Discovery
T1087.002 Account Discovery: Domain Account
Credential Access
T1110.003 Brute Force: Password Spraying
Command and Control
Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
defense-impairment
Affected products and versions in MFA Coverage Gaps (Cloud-only MFA, VPN, RDP, Windows Logon)
- SonicWall — SSL VPN (accounts without MFA)
Vulnerable versions: VPN accounts configured without multi-factor authentication
Fixed in: MFA enforced on all VPN accounts - Microsoft — Windows RDP / Windows logon / Active Directory-backed services
Vulnerable versions: Deployments where MFA covers only cloud/SaaS applications
Fixed in: MFA enforced for RDP, Windows logon and VPN
Remediation for MFA Coverage Gaps (Cloud-only MFA, VPN, RDP, Windows Logon)
Patches
- Apply SonicWall patches for CVE-2024-40766 and follow current SonicWall guidance for SSL VPN devices
- Patch other VPN and backup products cited in AA24-109A (Cisco ASA/VPN, Veeam Backup & Replication)
Immediate actions
- Enforce MFA on every SonicWall/SSL VPN account and all other remote-access accounts
- Review VPN authentication logs for password-spraying patterns and failed-then-successful logins from the same source
- Block or alert on new RDP sessions to domain controllers originating from VPN address pools
- Alert on msconfig.exe or bcdedit changes that set Safe Mode boot, and on unsanctioned AnyDesk, WinRAR and s5cmd installs
Workarounds
- Restrict VPN and RDP exposure by IP allow-listing and gateway-based access
- Rotate credentials and OTP seeds for VPN accounts after any suspected exposure
- Disable or remove unused VPN accounts and enforce lockout thresholds
Longer-term hardening
- Extend MFA from cloud/SaaS apps to on-premises systems, RDP and Windows logon
- Regularly audit Active Directory passwords and block weak, reused or breached passwords
- Feed VPN, RDP and Windows authentication telemetry into the SIEM/SOC
- Assess device trust alongside credential verification for remote access
- Keep EDR tamper protection enabled and monitor for Safe Mode boots
Weaknesses (CWE) in MFA Coverage Gaps (Cloud-only MFA, VPN, RDP, Windows Logon)
Timeline of MFA Coverage Gaps (Cloud-only MFA, VPN, RDP, Windows Logon)
- CISA, FBI, Europol EC3 and the Netherlands NCSC publish joint #StopRansomware advisory AA24-109A on Akira TTPs and IOCs, noting VPN access without MFA as a favored entry point.
- Start of the Akira campaign against SonicWall SSL VPNs reported in 2025 (devices running SonicOS 6-8), with reports of MFA bypass via compromised OTP seeds.
- H-ISAC publishes a TLP:White bulletin that Akira ransomware is actively targeting SonicWall SSL VPNs.
- CISA and partners update AA24-109A with new Akira TTPs, CVEs (including CVE-2024-40766) and IOCs.
- Attacker reboots a host into Safe Mode with Networking via msconfig.exe to prevent EDR and Defender real-time protection from starting; encryption fails and Defender quarantines akira.exe after the host returns to normal mode, under five hours after initial access.
- Akira affiliate gains access via exposed SonicWall SSL VPN account without MFA after failed logins, then RDPs to a domain controller about two hours later, enumerates Active Directory, archives file shares with WinRAR, uploads them with s5cmd to an attacker-controlled S3 bucket and installs AnyDesk.
- BleepingComputer reports the Huntress analysis of the Akira Safe Mode intrusion.
- Sponsored BleepingComputer/Specops article on MFA coverage gaps cites the Akira incident and credential-theft statistics (Verizon DBIR 44.7%, Mandiant 21% initial access and ~85% RDP lateral movement).
Sources cited for MFA Coverage Gaps (Cloud-only MFA, VPN, RDP, Windows Logon)
- The MFA Gaps Attackers are Still Exploiting (sponsored by Specops Software)
- Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt
- CISA/FBI #StopRansomware: Akira Ransomware (AA24-109A)
- H-ISAC TLP:White Threat Bulletin: Akira Ransomware Is Actively Targeting SonicWall SSL VPNs
- Akira Ransomware bypasses MFA on SonicWall VPNs (Security Affairs)
- M-Trends 2026: Data, Insights, and Strategies From the Frontlines (Google Cloud / Mandiant)
- CISA flags imminent threat as Akira ransomware starts hitting Nutanix AHV (The Register)
- Akira ransomware using compromised credentials and public tools (Cyber Security News)
Detection coverage for TL-2026-3429
As of 2026-10-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3429 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.