On August 4, 2026, an Akira ransomware affiliate began password-spraying a SonicWall SSL VPN. Approximately seven minutes later, one attempt succeeded. The VPN account had no multi-factor authentication enabled. Within roughly two hours, the attacker used Remote Desktop Protocol (RDP) to access the domain controller, enumerate Active Directory, and steal credentials and file-share data. The ransomware deployment ultimately failed, but the attacker had already exfiltrated sensitive information.
The incident illustrates a common issue: organizations often require MFA for cloud services such as Microsoft 365 while leaving other access methods like VPNs and RDP protected only by passwords. Mandiant's 2025 ransomware investigations found that compromised legitimate credentials accounted for initial access in 21% of incidents where the entry point could be established, typically through RDP or VPN. RDP was also used for lateral movement in approximately 85% of ransomware incidents Mandiant investigated.
Verizon's Data Breach Investigations Report found that stolen credentials are involved in 44.7% of breaches. The article, sponsored by Specops Software, notes that AI is adding to the threat by helping attackers operate at greater speed and scale, even as underlying identity tactics remain unchanged.
To address credential risk, the article recommends regular password auditing to identify weak, reused, or previously breached passwords. Specops Password Auditor is described as a free, read-only tool that scans Active Directory and produces interactive reports on password-related vulnerabilities, giving IT teams a chance to reduce credential risk at the source.