A single unprotected login was all it took. On Aug. 4, 2026, an affiliate of the Akira ransomware operation broke into a corporate network by exploiting a vulnerability in SonicWall's SSL VPN, using a password-spraying technique against an account that had no multi-factor authentication attached to it. The intrusion, first detailed by Bleeping Computer, resulted in stolen credentials and file-share data before the ransomware payload itself failed to deploy - a partial failure that offers little comfort given how far the attackers had already gotten.
What makes the incident instructive rather than merely alarming is the pattern it reveals. Many organizations have spent years hardening their cloud applications with layered authentication, treating MFA as standard practice for email, collaboration tools, and software-as-a-service platforms. Remote access infrastructure - VPN gateways, RDP sessions, legacy Windows logons - often gets left behind in that modernization effort, guarded by nothing more than a username and a password that may already be circulating on criminal forums. For travelers and remote workers who rely on a VPN for everyday convenience, such as keeping access to Hulu on a trip, that same tunnel can become a liability when the provider or the organization behind it skips modern authentication safeguards. The SonicWall case shows how a gap invisible to most users becomes an open door to attackers.
Why Password Spraying Still Works
Password spraying is not a sophisticated technique in the way that, say, a zero-day exploit chain might be. It relies on volume and patience: attackers try a small number of commonly used passwords against many accounts, avoiding the lockouts that would trigger from repeated attempts on a single login. What has changed is speed and scale. Automation and AI-assisted tooling let threat actors test credentials against thousands of endpoints in a fraction of the time it once took, turning a slow, manual nuisance into an efficient reconnaissance method. When a VPN account requires only a password to succeed, that automation has nothing standing in its way.
Credentials as the Preferred Entry Point
Mandiant's review of ransomware incidents in 2025 found that compromised credentials served as the initial access vector in roughly one in five cases, with RDP frequently used afterward for lateral movement across a victim's network. That statistic matters because it points away from the popular image of ransomware as a purely technical exploit and toward something more mundane: stolen or guessed login details, reused across systems that were never designed to assume hostile traffic. VPNs and RDP were built for convenience and remote productivity, not as hardened perimeter defenses against credential-based attacks, and that mismatch is now routinely exploited.
Closing the Authentication Gap
The practical lesson from the Akira incident is narrow but urgent: organizations need to audit every point where a password alone still grants access. That includes VPN concentrators, RDP endpoints, local Windows accounts, and any legacy system that predates the current emphasis on cloud security. Extending MFA to these access points does not eliminate risk entirely, but it removes the single point of failure that password spraying depends on. A stolen password becomes far less useful to an attacker when a second factor stands between it and the network. In an environment where credential theft is cheap, automated, and increasingly augmented by AI, that extra layer is no longer optional - it is the baseline.