Back Bleepingcomputer

The MFA Gaps Attackers are Still Exploiting

Bleepingcomputer •Sponsored by Specops Software • October 13, 2026

Attackers continue exploiting gaps in MFA coverage, using stolen credentials to access VPNs, RDP, and Windows systems that still rely on passwords alone. Specops explains why protecting cloud applications isn't enough and how organizations can close these authentication gaps. [...]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Attackers Exploit MFA Gaps in SonicWall VPN Access On August 4, 2026, an Akira ransomware affiliate successfully accessed a SonicWall SSL VPN by spraying passwords, exploiting the lack of multi-factor authentication (MFA). After gaining access, the attacker used RDP to reach the domain controller and enumerate Active Directory, although the ransomware deployment ultimately failed. This incident illustrates a persistent issue where organizations enforce MFA on certain applications but neglect other access paths. Stolen credentials remain a significant threat, with Mandiant reporting that compromised credentials were involved in 21% of ransomware incidents in 2025. Regular password auditing is recommended to mitigate risks associated with weak or reused passwords. The use of AI by attackers is increasing the speed and scale of these attacks, making traditional defenses less effective. 3 sources 55

The MFA Gaps Attackers are Still Exploiting

The full story

Extracted Entities

MITRE ATT&CK (1)

Platforms (1)