GoKawiilAkira ransomware affiliate breached SonicWall VPN lacking MFA, Mandiant reports
Mandiant detailed an August 4, 2026 Akira ransomware intrusion in which an affiliate brute-forced a SonicWall SSL VPN account that had no multi-factor authentication, gaining access within minutes. The attacker then used RDP to reach the domain controller, enumerate Active Directory, and steal credentials and file-share data, though the ransomware payload itself failed to deploy. Mandiant's 2025 data shows compromised credentials caused 21% of ransomware incidents with a known entry point, and RDP was used for lateral movement in about 85% of cases.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident suggests many organizations still apply MFA unevenly, protecting SaaS tools like Microsoft 365 while leaving VPN or RDP access secured only by passwords, which attackers can exploit as an easier entry point. Mandiant's data indicates this is not an isolated case but a recurring pattern underlying a large share of ransomware intrusions. The report also implies that AI tools may let attackers scale credential-based attacks faster, even though the underlying tactics—password spraying, lateral movement via RDP—remain largely unchanged.
- An Akira ransomware affiliate compromised a SonicWall VPN account lacking MFA and moved laterally via RDP before the ransomware deployment failed.
- Mandiant found compromised credentials caused 21% of 2025 ransomware incidents with identifiable entry points, often via VPN or RDP.
- RDP was used for lateral movement in roughly 85% of ransomware cases Mandiant investigated, underscoring gaps in MFA coverage beyond SaaS applications.
YubiKey 5 NFC Security Key — This article underscores how password-only VPN and remote-access accounts remain a glaring MFA gap attackers exploit. A hardware key like the YubiKey 5 NFC enforces phishing-resistant, true multi-factor authentication on exactly these overlooked access points—VPNs, RDP gateways, and admin accounts—closing the door attackers keep finding open. It's a simple, durable way to extend strong MFA beyond just SaaS logins.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-13
Published there as: “The MFA Gaps Attackers are Still Exploiting”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.