Attackers Still Exploiting Multi-Factor Authentication Gaps

Attackers are continuing to exploit critical gaps in multi-factor authentication (MFA) coverage, leveraging stolen credentials to compromise systems such as VPNs, RDP, and Windows logons that often remain protected by only a single password.

Despite widespread adoption of MFA for cloud applications, many organisations still leave on-premise access paths vulnerable, creating a fragmented security landscape that cybercriminals readily target.

A notable incident in August 2026 saw an Akira ransomware affiliate successfully breach a SonicWall SSL VPN. The attackers used password spraying techniques, finding valid credentials for a VPN account that lacked MFA protection. Within hours, the threat actor moved to access the domain controller via RDP, enumerated Active Directory, and stole credentials and file-share data, though the ransomware deployment itself ultimately failed.

This case exemplifies a persistent issue where strong cloud security measures do not automatically extend to an organisation’s entire Windows estate, leaving vital internal systems exposed. Cybersecurity experts highlight that this gap allows attackers, potentially aided by AI for speed and scale, to misuse legitimate access once initial credentials are compromised.

The Persistent Threat of Stolen Credentials

Data from Mandiant’s ransomware investigations reveals that compromised legitimate credentials were the initial access vector in 21% of 2025 incidents where the entry point could be identified, frequently involving RDP or VPNs. RDP also played a significant role in lateral movement, with attackers using compromised or newly created accounts in approximately 85% of the investigated ransomware incidents.

Further underscoring the severity of this threat, the Verizon Data Breach Investigations Report consistently finds stolen credentials involved in a substantial percentage of breaches, accounting for 44.7% of incidents in their latest findings.

Why Cloud MFA Doesn’t Cover Everything

Organisations typically prioritise MFA for internet-facing Microsoft 365 instances, identity providers, and other SaaS applications due to their high visibility and frequent targeting. However, this cloud-centric approach often fails to extend MFA to every system that relies on the same user identity.

This means a user might require MFA for a cloud application, but the identical account could still grant access to internal resources via a VPN, RDP session, Windows logon, or older Active Directory-backed services using only a password. This creates critical authentication gaps that attackers actively seek to exploit.

Closing Authentication Gaps for Enhanced Security

To mitigate this risk, organisations must broaden their strong authentication strategy beyond cloud applications. This involves implementing MFA for all critical access points that still trust credentials alone, including:

• Windows logon
• RDP sessions
• VPN access
• Older Active Directory-backed services

By applying additional protective layers to these commonly targeted pathways, organisations can significantly reduce the utility of stolen passwords for attackers. Integrating authentication events into Security Information and Event Management (SIEM) platforms also provides valuable telemetry for monitoring suspicious activity.

Ultimately, comprehensive MFA coverage is paramount. Organisations should regularly review where a single password can still grant access and proactively implement multi-factor authentication to ensure that one stolen credential does not provide an easy entry point into the wider network.