MFA Vulnerabilities: How Attackers Exploit Security Gaps

Post Views: 1

The MFA Gaps Attackers are Still Exploiting On August 4, 2026, an Akira ransomware affiliate initiated a password spraying campaign targeting a SonicWall SSL VPN.

The Incident

Within seven minutes, one attempt succeeded, granting access to a VPN account that lacked multi-factor authentication (MFA) protections. Two hours later, the attacker leveraged Remote Desktop Protocol (RDP) to connect to a domain controller and began enumerating Active Directory. Although the ransomware deployment ultimately failed, the adversary had already exfiltrated credentials and file-share data.

Stolen Credentials and AI

This incident underscores a persistent vulnerability in 2026, where organizations often enforce MFA for Microsoft 365 and other cloud applications but leave critical access points exposed through password-only authentication. Attackers continue to exploit these gaps, highlighting the need for comprehensive authentication strategies. Stolen credentials remain a critical enabler for cyber adversaries.

AI and Attack Workflows

The integration of artificial intelligence into attack workflows has amplified this threat by enabling faster, larger-scale operations. Despite advancements, core identity-based tactics persist: credential compromise, reuse, privilege escalation, and legitimate access misuse. The rise of AI lowers the cost and complexity of executing these techniques at scale, as evidenced by Mandiant’s ransomware investigations.

RDP and Lateral Movement

In 21% of 2025 incidents where initial access was determined, compromised credentials served as the entry point, often via RDP or VPN. RDP also featured prominently in later stages of attacks, with adversaries using either stolen or newly created accounts for lateral movement in 85% of cases.

Password Audits and Tools

Identifying and mitigating exposed credentials is essential for reducing risk. While strong authentication limits an attacker’s capabilities after a password is stolen, proactive measures are necessary to detect vulnerabilities before exploitation. Password reuse, weak password choices, and credentials linked to prior breaches increase the likelihood of successful attacks.

Specops Password Auditor

Regular password audits within Active Directory can help address these risks. Tools like Specops Password Auditor offer a free, read-only solution for scanning Active Directory environments, identifying password-related weaknesses, and generating interactive reports. This allows IT teams to address vulnerabilities at their source, reinforcing defenses against compromised credentials.

Cloud MFA Limitations

Cloud-based MFA solutions, while effective for internet-facing services like Microsoft 365, do not inherently secure all systems relying on the same user identities. A user might require MFA for SaaS applications but still face risks if the same account is accepted via password-only access elsewhere. This creates a fragmented authentication landscape, where some access paths are better protected than others.

The Akira Attack Example

The August Akira ransomware attack exemplifies this risk: an attacker with valid credentials could bypass MFA protections and gain direct network access through a VPN. For security teams, the critical question is not just whether MFA is deployed but where password-only authentication remains the sole barrier.

Solutions for Comprehensive MFA

Windows logons, RDP sessions, VPNs, and legacy Active Directory-dependent services should all be evaluated for MFA implementation. Solutions like Specops Secure Access address this by enforcing MFA for Windows logons, RDP, and VPN authentication. This strengthens defenses against attacks targeting stolen Active Directory credentials while supporting single sign-on (SSO) for SaaS applications through OpenID Connect (OIDC) and Security Assertion Markup Language (SAML).

Integration and Threat Detection

Integration with Security Information and Event Management (SIEM) systems, security operations centers (SOCs), and analytics platforms further enhances threat detection by leveraging authentication telemetry.

Device Trust and Layered Protections

Beyond user authentication, device trustworthiness must also be assessed. Stolen passwords remain a potent threat if they are accepted by VPNs, RDP sessions, or Windows systems without additional verification. MFA coverage is as critical as its adoption, as securing cloud applications alone does not eliminate risks from unsecured authentication paths.

Verizon Data Breach Investigations Report

The Verizon Data Breach Investigations Report underscores the prevalence of stolen credentials in breaches, with 44.7% of incidents involving compromised login details.

Conclusion

No single control can prevent all breaches, but implementing layered protections significantly reduces the utility of stolen credentials. By addressing gaps in identity security strategies—such as those highlighted by tools like Specops Secure Access—organizations can ensure that a single compromised credential does not become a gateway to broader network infiltration. The evolving threat landscape demands continuous evaluation of authentication practices to align with modern attack vectors.