SonicWall SSL VPN shows why MFA must cover every access point
An August 4, 2026 intrusion used a SonicWall SSL VPN without MFA, enabling rapid credential use and later access to internal systems, underscoring why authentication must cover all paths.
An August 4, 2026 incident targeted a SonicWall SSL VPN with password-only access, leading to rapid credential use and later access to internal directory services.
The episode highlights a persistent problem: organizations often require MFA for cloud apps but overlook on-prem paths like Windows logon, RDP, and VPN.
Strong authentication must cover every access point, not just online services; attackers exploit gaps to reuse compromised credentials at scale.
Mitigations include extending MFA to Windows logon, RDP, VPN, and using password auditing and credential hygiene tools.
Quick read · 1 min
A ransomware episode in August 2026 showed attackers bypassing MFA by targeting password-only paths. An Akira affiliate gained initial access to a SonicWall SSL VPN lacking MFA, then moved laterally via a remote desktop session to reach a domain controller. The attack did not complete, but credentials and data were exposed. The incident underscores why MFA must cover every access point, not just cloud services.
What this means for you: organizations should extend strong authentication to Windows logon, RDP, and VPNs. If you run a business, ask about password auditing and how they’re hardening on-prem paths. If you’re an employee, ensure your company enforces MFA beyond cloud apps.
A ransomware episode in early August 2026 reveals a worrying weakness: attackers can exploit MFA gaps by targeting password-only entry points. An Akira ransomware affiliate began testing a SonicWall SSL VPN on August 4, 2026, and quickly gained a foothold because the VPN hadn’t been protected with MFA. About two hours after that initial access, the attacker moved laterally via a remote desktop session to reach the domain controller and start exploring Active Directory. The operation didn’t complete as planned, but sensitive credentials and file-share data ended up in the attacker’s hands.
What this shows is that even when many cloud services are secured with MFA, critical on‑prem access paths can still be opened with a password. Attackers can move fast once they have valid credentials, using the same methods legitimate users rely on to do their work. In 2025, compromised credentials accounted for a meaningful share of breaches where the entry point could be established, and AI tools are helping attackers scale these techniques even faster.
Why this matters to regular readers is straightforward: a company’s security can depend on more than what you see in a dashboard. If MFA is strong for cloud apps but weak for Windows logon, RDP, or VPN, a breach can still occur even with solid cloud defenses.
01
Where MFA gaps show up
The report points to common blind spots: Windows logon, RDP, and VPNs are frequent targets because they are often trusted by the network and can be reached from outside the corporate network. If MFA isn’t enforced there, a stolen password can unlock a broader environment.
02
Why attackers rely on passwords in the first place
Stolen credentials remain valuable tools. Even with cloud MFA in place, attackers can gain footholds through traditional password-based access points. Once inside, they can escalate privileges and explore the network, sometimes staying under the radar longer than other methods.
03
What to do now for organizations
Experts recommend extending strong authentication to all critical access paths, including Windows logon, RDP, and VPN. Regular password auditing can help identify weak or exposed credentials before attackers exploit them. Tools that provide visibility into where passwords are still accepted can help security teams tighten controls and reduce risk.
04
What this means for everyday people
If you’re an employee or a small business owner, the takeaway is simple: ask your IT team whether MFA covers every access point, not just cloud apps. If you manage your own systems, apply MFA to VPNs and remote access, and consider password hygiene measures like reviewing credential reuse and updating old accounts that may still have password-based access paths.
Security watchers expect more emphasis on extending MFA to on-prem paths and validating that password-based access can no longer bypass protections. If your organization hasn’t done this yet, start with a quick audit of access points that accept passwords without MFA and prioritize those for immediate hardening.
06
Quick answers
What happened in this incident?
A ransomware group accessed a SonicWall SSL VPN without MFA, then used a remote desktop session to reach the domain controller and probe Active Directory.
Why does this matter to me?
If your organization relies on MFA only for cloud apps, you could still face a breach via password-based paths like VPNs or remote desktop.
For individuals, it means checking that any company you work with or services you use enforce MFA on all remote access points.
Security researchers exposed a chain of flaws in LG webOS that could give a local-network attacker root access to certain TVs without user interaction; LG pushed a firmware fix after the advisory.
