An Akira ransomware affiliate exploited a SonicWall SSL VPN vulnerability on Aug. 4, 2026, by spraying passwords, demonstrating a common security gap where organizations implement multi-factor authentication (MFA) for cloud services but leave other access points vulnerable. The attack, which succeeded due to a lack of MFA on the VPN account, led to the theft of credentials and file-share data, even though the ransomware deployment ultimately failed, with further coverage provided by Bleeping Computer.
The incident underscores a persistent issue in 2026: while many organizations secure cloud applications with MFA, critical access points like VPNs and Remote Desktop Protocol (RDP) often remain protected solely by passwords. Attackers exploit this by using stolen credentials, a tactic amplified by AI, which enables faster and broader attacks. Mandiant reported that compromised credentials were the initial access vector in 21% of ransomware incidents investigated in 2025, with RDP frequently used for lateral movement. This highlights the need to extend strong authentication beyond cloud services to include Windows logons, RDP, and VPN access. Organizations must review where passwords alone are still accepted and implement MFA to close these authentication gaps, thereby reducing the risk posed by credential theft and making stolen passwords less effective for attackers.
Source: Bleeping Computer
