Attackers Exploit Unprotected Access Paths While Organizations Deploy MFA Selectively

On August 4, 2026, an Akira ransomware affiliate conducted a password spray campaign targeting a SonicWall SSL VPN. Within seven minutes, a valid credential was discovered. The compromised account lacked multi-factor authentication protection. Two hours later, the attacker leveraged RDP to reach the domain controller and started mapping Active Directory resources.

Although the ransomware deployment ultimately did not succeed, the attacker had already exfiltrated user credentials and file-share contents. The incident underscores a persistent vulnerability in 2026 environments: many organizations mandate MFA for Microsoft 365 and other cloud platforms while leaving alternative access routes—such as VPNs and remote desktop services—defended solely by passwords. Threat actors routinely target these unprotected pathways.

Compromised Credentials Remain an Effective Attack Vector

Once attackers obtain valid credentials, they can interact with systems using the same authentication channels that legitimate staff employ. Artificial intelligence is amplifying this threat by enabling attackers to conduct campaigns faster and at greater scale.

The fundamental identity-based tactics remain consistent: credential compromise, credential reuse, privilege escalation and abuse of legitimate access rights. The shift is that AI reduces the cost and effort required to execute these techniques across large target sets.

Mandiant's analysis of ransomware investigations shows the significance of this pattern. Compromised legitimate credentials served as the initial access vector in 21% of 2025 incidents where the entry method was identifiable, typically through RDP or VPN connections.

RDP appeared repeatedly during later stages of attacks as well. Attackers used compromised or newly provisioned accounts over RDP for lateral movement in roughly 85% of the ransomware cases Mandiant examined.

Detecting Exposed Credentials Before Exploitation

Robust authentication mechanisms limit the damage an attacker can inflict with a stolen password, yet identifying exposed or weak credentials before misuse occurs remains valuable. Password reuse across systems, poor password selection and credentials appearing in historical breach databases all increase the likelihood that an attacker will discover a working password somewhere in the infrastructure.

Periodic password auditing becomes an important component of Active Directory security. Tools like Specops Password Auditor, a free read-only utility, scan Active Directory for password-related weaknesses and generate interactive reports containing user and password policy details.

This approach gives security and IT teams a chance to reduce credential risk at its source: locate password deficiencies, remediate them where feasible, and ensure that a single compromised password cannot independently grant access.

Cloud-Based MFA Does Not Automatically Protect All Windows Systems

Microsoft 365, identity platforms and SaaS services are logical places to implement additional authentication factors due to their internet exposure and frequent targeting. However, cloud MFA does not automatically extend protection to all systems that authenticate using the same user identity.

A user might be required to provide MFA when accessing a SaaS application through the organization's identity provider, yet the same account could still be accepted elsewhere using only a password.

This fragmented authentication model creates inconsistent protection levels across different access routes, providing attackers with exploitable gaps.

VPNs represent another potential weakness. As the August Akira incident demonstrated, an attacker who obtains or brute-forces valid credentials may convert them directly into remote network access if MFA is not enforced at the VPN layer.

For IT and security teams, the critical question shifts from simply whether MFA exists to where passwords alone remain sufficient. Windows logon, RDP, VPN access and legacy Active Directory-integrated services all warrant inclusion in this assessment.

Addressing Authentication Gaps Across the Environment

Reducing these gaps requires extending stronger authentication to locations where passwords continue to be accepted without additional verification, rather than restricting MFA to cloud application entry points.

Solutions such as Specops Secure Access extend MFA coverage to Windows logon, RDP and VPN authentication, adding robust protection to the access paths that attackers frequently target using stolen Active Directory credentials.

The platform also provides single sign-on for SaaS applications via OIDC and SAML, enabling organizations to implement a more uniform authentication strategy spanning both on-premises and cloud infrastructure.

Authentication systems also serve as a source of security telemetry. Specops Secure Access feeds authentication events and anomalous activity into SIEM, SOC and analytics platforms, integrating this data into broader security monitoring workflows.

User protection represents only one dimension. A parallel consideration involves whether the device initiating the request warrants trust.

Reducing the Impact of Password Compromise

In 2026, stolen passwords remain potent attack tools if VPNs, RDP sessions or Windows systems accept them without supplementary verification. Consequently, the breadth of MFA deployment matters as much as MFA adoption itself. Securing cloud applications is necessary, but it does not eliminate risk from other authentication pathways in the environment that still depend on passwords alone.

No single security control prevents all intrusions, and MFA is not an exception. However, organizations can substantially reduce the value of credential theft by examining one fundamental question: where can a password still function independently?

Implementing additional protective measures in those areas using solutions like Specops Secure Access ensures that a single stolen credential does not become the simplest pathway into the broader network.