Attackers continue to exploit gaps in MFA to gain access to corporate networks using stolen credentials.

 

What happened

Attackers continue to exploit gaps in multi-factor authentication (MFA), using stolen or compromised credentials to access corporate networks through virtual private networks (VPNs), Remote Desktop Protocol (RDP), and Windows systems that lack additional authentication protections.

In an article published in October 2026, BleepingComputer reported on an August ransomware incident in which an Akira ransomware affiliate targeted a SonicWall Secure Socket Layer (SSL) VPN using password spraying. The technique involves attempting to access accounts using a selection of passwords across multiple usernames.

 

Going deeper

According to the report, one login attempt succeeded approximately seven minutes after the attack began. The account had valid credentials but was not protected by MFA. Around two hours later, the attacker used RDP to access a domain controller and began examining the organization's Active Directory environment. Although the ransomware deployment ultimately failed, the attacker had already stolen credentials and file-share data.

The incident shows how attackers can exploit inconsistencies in an organization's authentication controls. While businesses may require MFA for Microsoft 365 and other cloud applications, they may leave VPNs, remote desktop connections, and other systems accessible with passwords alone.

 

In the know

MFA requires users to verify their identity using two or more different authentication factors, such as a password and a one-time code or an authentication prompt. It provides an additional layer of protection when passwords are stolen, guessed, or reused. However, enabling MFA for one service does not automatically protect every system connected to the same user account. If an organization's VPN or Windows environment accepts password-only authentication, an attacker may be able to bypass the protections applied to cloud applications.

The consequences can extend beyond unauthorized access to a single account. Once inside a network, attackers may use legitimate credentials to move between systems, discover sensitive information, escalate privileges, and prepare for ransomware deployment.

Research from Google-owned cybersecurity firm Mandiant shows how often attackers exploit legitimate accounts. Mandiant's report found that compromised legitimate credentials were used to gain initial access in 21% of the ransomware incidents it investigated in 2025 where the entry point was known. These incidents often involved RDP or VPN access. In approximately 85% of the ransomware incidents investigated, attackers also used compromised or newly created accounts through RDP to move between systems.

Artificial intelligence (AI) may further increase the scale and speed of these attacks by making established techniques easier to carry out. However, the underlying problem remains the abuse of legitimate accounts and authentication methods that do not provide sufficient protection.

To reduce these risks, organizations should review MFA coverage across their entire IT environment, including VPNs, RDP, Windows logins, and legacy services connected to Active Directory. Regular password audits can also help identify weak, reused, or previously exposed credentials before attackers exploit them.

 

The bigger picture

Healthcare organizations are attractive targets for credential-based attacks because their systems contain sensitive patient information, including protected health information (PHI), medical records, and billing data. Gaps in MFA can leave these systems exposed, even when organizations have invested in securing their cloud accounts.

If attackers gain access to a hospital's VPN or remote desktop systems using stolen credentials, they could potentially access patient records, disrupt clinical systems, or deploy ransomware that affects patient care. A compromised account could also provide a route to other systems containing sensitive information.

Healthcare organizations should ensure that MFA is required across remote access services, email, electronic health record (EHR) systems, and administrator accounts. They should also restrict remote access to authorized users, monitor unusual login activity, and regularly review user permissions. Password-only access to legacy systems should be addressed, particularly where those systems connect to networks containing patient data.

These measures are important for both cybersecurity and regulatory compliance.

 

Why it matters

MFA coverage is just as important as MFA adoption. Organizations may invest in securing cloud accounts but remain vulnerable if attackers can use the same credentials to access unprotected systems.

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQS

Why are VPNs and RDP common targets for attackers?

Virtual private networks (VPNs) and Remote Desktop Protocol (RDP) allow users to access systems remotely. If these services use weak passwords or lack MFA, attackers can exploit stolen credentials to enter corporate networks.

 

What is lateral movement in a cyberattack?

Lateral movement occurs when an attacker moves from one compromised account or system to another within a network. Attackers may use stolen credentials to access sensitive data, obtain additional privileges, or identify systems to target with ransomware.

 

What should organizations do if an employee's credentials are compromised?

Organizations should reset affected passwords, revoke active sessions and tokens where appropriate, and investigate potentially unauthorized access. Security teams should also review authentication logs and check whether the attacker accessed other systems or sensitive information.