GoKawiilAkira ransomware affiliate breached SonicWall VPN lacking MFA, Mandiant reports
Mandiant detailed an August 4, 2026 Akira ransomware intrusion in which an affiliate brute-forced a SonicWall SSL VPN account that had no multi-factor authentication, gaining access within minutes. The attacker then used RDP to reach the domain controller, enumerate Active Directory, and steal credentials and file-share data, though the ransomware payload itself failed to deploy. Mandiant's 2025 data shows compromised credentials caused 21% of ransomware incidents with a known entry point, and RDP was used for lateral movement in about 85% of cases.