# MFA Coverage Gaps (Cloud-only MFA, VPN, RDP, Windows Logon) Exploited with Stolen Credentials - Akira Affiliate SonicWall VPN Intrusion (Aug 2026)

> MFA is often enforced only on cloud/SaaS apps while VPN, RDP and Windows logon accept password-only authentication, and ransomware affiliates exploit that gap with stolen or sprayed credentials. On 2026-08-04 an Akira affiliate logged in to an exposed SonicWall SSL VPN account with no MFA and reached a domain controller over RDP about two hours later.

- **Published:** 2026-10-13T17:28:09Z
- **Last reviewed:** 2026-10-13T17:28:09Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3429
- **ID:** TL-2026-3429
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Akira ransomware affiliate
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This item is a control-gap threat rather than a new vulnerability: no CVE is involved. A sponsored BleepingComputer article (Specops Software, published 2026-10-13) argues that organizations deploy MFA on cloud and SaaS applications (for example Microsoft 365) but leave on-premises and remote-access paths protected by passwords alone: VPN gateways, RDP, Windows interactive logon and legacy Active Directory-backed services. Attackers use stolen, reused or sprayed credentials to enter through whichever path lacks a second factor. The article is sponsored content and promotes Specops products, so the statistics below are secondary citations.

Statistics cited by the article: stolen credentials are involved in 44.7% of breaches (Verizon DBIR); compromised credentials were the initial access vector in 21% of 2025 ransomware incidents, and compromised or newly created accounts were used over RDP for lateral movement in about 85% of ransomware incidents (Mandiant / Google Cloud Threat Intelligence ransomware TTP analysis). Google's M-Trends 2026 also reports that compromised credentials accounted for 21% of ransomware intrusions, gathered through infostealer logs or purchased on underground forums.

The case study is an Akira ransomware affiliate intrusion on 2026-08-04, documented by Huntress and reported by BleepingComputer on 2026-08-13. Initial access was an exposed SonicWall SSL VPN account that had no MFA. The attacker made several failed logins, and the article reports about seven minutes to valid credentials via password spraying. About two hours after the successful VPN login the attacker connected over RDP to a domain controller, enumerated Active Directory users and computers, and moved to an application server. The attacker used WinRAR to archive mapped file shares and s5cmd to upload the data to an attacker-controlled S3 bucket. The attacker installed AnyDesk as a persistent remote channel and staged the akira.exe payload. The attacker forced a reboot into Safe Mode with Networking through msconfig.exe so that EDR services and Defender real-time protection would not start. This was the first time Huntress had seen Akira use that evasion. Encryption failed because of insufficient virtual memory in Safe Mode, and Defender quarantined the executable after the host returned to normal mode. The whole intrusion lasted under five hours, and credentials and file-share data were still stolen for extortion.

Broader Akira context from the CISA/FBI #StopRansomware advisory AA24-109A (updated 2025-11-13): Akira affiliates favor VPN services lacking MFA, exploit CVE-2024-40766 against SonicWall devices, and use credentials possibly obtained from access brokers. A 2025 campaign against SonicWall SSL VPNs also reportedly involved MFA bypass, via compromised OTP seeds or an undetermined zero-day. Defenders should enforce phishing-resistant MFA on every remote-access and logon path, audit Active Directory for weak and breached passwords, alert on password spraying against VPN gateways, and monitor for new RDP sessions to domain controllers, bulk archiving, S3 uploads and unsanctioned remote-access tools.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1133 External Remote Services
- T1110.003 Brute Force: Password Spraying
- T1021.001 Remote Services: Remote Desktop Protocol
- T1087.002 Account Discovery: Domain Account
- T1039 Data from Network Shared Drive
- T1560.001 Archive Collected Data: Archive via Utility
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1219 Remote Access Tools
- T1688 Safe Mode Boot

## Sources

- [The MFA Gaps Attackers are Still Exploiting (sponsored by Specops Software)](https://www.bleepingcomputer.com/news/security/the-mfa-gaps-attackers-are-still-exploiting/)
- [Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt](https://www.bleepingcomputer.com/news/security/akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt/)
- [CISA/FBI #StopRansomware: Akira Ransomware (AA24-109A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a)
- [H-ISAC TLP:White Threat Bulletin: Akira Ransomware Is Actively Targeting SonicWall SSL VPNs](https://www.aha.org/system/files/media/file/2025/08/h-isac-tlp-white-threat-bulletin-akira-ransomware-is-actively-targeting-sonicwall-ssl-vpns-8-4-2025.pdf)
- [Akira Ransomware bypasses MFA on SonicWall VPNs (Security Affairs)](https://securityaffairs.com/182732/cyber-crime/akira-ransomware-bypasses-mfa-on-sonicwall-vpns.html)
- [M-Trends 2026: Data, Insights, and Strategies From the Frontlines (Google Cloud / Mandiant)](https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026)
- [CISA flags imminent threat as Akira ransomware starts hitting Nutanix AHV (The Register)](https://www.theregister.com/2025/11/14/cisa_akira_ransomware/)
- [Akira ransomware using compromised credentials and public tools (Cyber Security News)](https://cybersecuritynews.com/akira-ransomware-using-compromised-credentials-and-public-tools/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3429