SecurityNot yet confirmed elsewhere1 publisher2 min readPublished
Akira affiliate took a password-only SonicWall VPN account to the domain controller in about two hours
An Akira affiliate began spraying passwords at a SonicWall SSL VPN on August 4, 2026, and one worked about seven minutes later. The account had no MFA, and the ransomware deployment that followed failed after credentials and file-share data were already stolen.
The Watch · Security desk
Mandiant found valid credentials gave initial access in 21% of 2025 ransomware incidents where the entry point was established, and accounts were used over RDP for lateral movement in around 85% of cases. Verizon's DBIR found stolen credentials in 44.7% of breaches.
- 21% of 2025 cases Initial access via valid credentials, per Mandiant, claim 7 where the entry point was established
- 85% of incidents Lateral movement over RDP, around, per Mandiant, claim 8 compromised or newly created accounts
- 44.7% of breaches Breaches involving stolen credentials, per Verizon, claim 9 Data Breach Investigations Report
| Figure | Value | Note | Claim |
|---|---|---|---|
| Initial access via valid credentials, per Mandiant | 21% of 2025 cases | where the entry point was established | 7 |
| Lateral movement over RDP, around, per Mandiant | 85% of incidents | compromised or newly created accounts | 8 |
| Breaches involving stolen credentials, per Verizon | 44.7% of breaches | Data Breach Investigations Report | 9 |
What happened
- Mandiant's ransomware cases show valid credentials as initial access in 21% of 2025 incidents where the entry point could be established, typically through RDP or VPN.
- Mandiant also found that in about 85% of the ransomware cases it investigated, attackers moved laterally over RDP using compromised accounts or ones they had created.
- Verizon's Data Breach Investigations Report found stolen credentials involved in 44.7% of breaches.
Why it matters
- exposure Any VPN account that relies on a password alone is open to the same spray, whatever else the organization has hardened.
- constraint Enforcing MFA on Microsoft 365 and the identity provider leaves the VPN path alone, because cloud MFA does not extend automatically to every system using the same identity.
- decision Defenders have to list every route where a password is enough by itself. The article names Windows logon, RDP, VPN access and older AD-backed services.
The entry point was a valid password [2]. BleepingComputer's account does not identify the victim, the SonicWall model, a software flaw or the reason the deployment failed. In our view the control that mattered was a second factor on that VPN account [3].
The timeline is short. Spraying against the SonicWall SSL VPN began on August 4, 2026 [1]. One attempt succeeded around seven minutes later [2]. The attacker used RDP to reach the domain controller roughly two hours after that [4]. Counting from the first spray, that is about 127 minutes, if the two hours runs from the login [14].
The article ties the intrusion to a pattern: organizations that require MFA for Microsoft 365 and other SaaS applications while leaving some access paths protected by passwords alone [6]. For this victim, it states only that the VPN account had no MFA [3]. The link to SaaS-only MFA is the article's framing of the pattern. It is not documented for this intrusion.
The route is a common one in Mandiant's ransomware data. Compromised legitimate credentials were the initial access in 21% of 2025 incidents where the entry point could be established, typically through RDP or VPN [7]. Once inside, attackers moved laterally over RDP using compromised accounts or ones they had created, in about 85% of the ransomware cases Mandiant investigated [8]. The article also cites Verizon's Data Breach Investigations Report, which found stolen credentials involved in 44.7% of breaches [9].
That points to a sustained pattern. The article says the underlying identity tactics are largely unchanged and that AI makes them cheaper and easier to run at scale [13].
The deployment failed [5]. The loss was already done: the attacker had stolen credentials and file-share data. Credentials taken from a domain controller's Active Directory are usable for the next intrusion.
The article is also a sales piece. Its remedy section recommends two Specops products, including Specops Password Auditor, a free read-only tool that scans Active Directory for password-related vulnerabilities [12].
What to watch
- Whether the SonicWall model and version in this case are published. Those details would confirm that the entry was a valid password and rule out a software flaw.
- Whether Mandiant's next ransomware data keeps valid credentials near 21% of known entry points.
- Whether further Akira intrusions through SonicWall VPNs show the same password-only accounts.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap+15
- Incentives80
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
On August 4, 2026, an Akira ransomware affiliate began spraying passwords against a SonicWall SSL VPN.
ReportedSupportedSource: BleepingComputer article 'The MFA Gaps Attackers are Still Exploiting'View cited source - [2]
Around seven minutes after the spraying began, one attempt succeeded; the credentials were valid.
- [3]
The VPN account had no multi-factor authentication (MFA) protecting it.
- [4]
Roughly two hours later, the attacker used RDP to access the domain controller and began enumerating Active Directory.
- [5]
The ransomware deployment ultimately failed, but by then the attacker had already stolen credentials and file-share data.
- [6]
The article says the incident highlights an issue still common in 2026, where an organization might require MFA for Microsoft 365 and other SaaS applications while leaving certain access paths protected only by passwords.
- [7]
Per Mandiant's ransomware investigations, compromised legitimate credentials accounted for initial access in 21% of the 2025 incidents where the entry point could be established, typically through RDP or VPN.
- [8]
Attackers used compromised or newly created accounts over RDP for lateral movement in around 85% of the ransomware incidents Mandiant investigated.
- [9]
Verizon's Data Breach Investigations Report found stolen credentials are involved in 44.7% of breaches.
- [10]
Cloud MFA does not automatically extend to every system that relies on the same user identity; a user may need MFA for a SaaS application through the corporate identity provider while the same account is accepted elsewhere with just a password.
- [11]
The article says Windows logon, RDP, VPN access and older AD-backed services are all worth including in a review of where a password is still enough on its own.
- [12]
The article recommends Specops products, including Specops Password Auditor, a free, read-only tool that scans Active Directory for password-related vulnerabilities, and Specops Secure Access for extending MFA.
- [13]
The article says the underlying identity tactics are largely unchanged and that AI makes familiar techniques cheaper and easier to run at scale.
- [14]
About 127 minutes from first password spray to domain controller access, if the roughly two hours is counted from the successful login.
Sources
1 independent publisher whose own reporting we read for this story.
- bleepingcomputer.comThe MFA Gaps Attackers are Still Exploiting
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.