Skip to content
Attackers Exploit MFA Gaps in SonicWall VPN Access

Attackers Exploit MFA Gaps in SonicWall VPN Access

First seen 13 Oct 2026, 16:34 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 13, 2026 at 17:33 UTC
  • •Akira ransomware exploited SonicWall SSL VPN due to lack of MFA.
  • •Compromised credentials accounted for 21% of ransomware incidents in 2025.
  • •Regular password auditing is essential to mitigate risks from weak passwords.

On August 4, 2026, an Akira ransomware affiliate successfully accessed a SonicWall SSL VPN by spraying passwords, exploiting the lack of multi-factor authentication (MFA). After gaining access, the attacker used RDP to reach the domain controller and enumerate Active Directory, although the ransomware deployment ultimately failed. This incident illustrates a persistent issue where organizations enforce MFA on certain applications but neglect other access paths. Stolen credentials remain a significant threat, with Mandiant reporting that compromised credentials were involved in 21% of ransomware incidents in 2025. Regular password auditing is recommended to mitigate risks associated with weak or reused passwords. The use of AI by attackers is increasing the speed and scale of these attacks, making traditional defenses less effective.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-08-04
Akira ransomware attack on SonicWall VPN
An attacker successfully accessed a SonicWall SSL VPN by spraying passwords, exploiting the absence of MFA.
BleepingComputer

More articles in this cluster (2)

Following this threat?

Track Akira in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (12)

1 / 3

Common questions

What systems were affected?
The attack targeted SonicWall SSL VPN systems that lacked multi-factor authentication.
How can we protect against similar attacks?
Implement multi-factor authentication across all access points and conduct regular password audits.
What is the current status of the attack?
The ransomware deployment failed, but the incident highlights ongoing vulnerabilities in MFA implementation.