[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCQBzAXfniplKZOUUlgqeKrLuG1j7aGKzFRvpi2zczIA":3},{"article":4,"iocs":56,"watch_terms":59,"solutions":60,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"78122186-3812-48d4-87fb-cb290a12f22a","The MFA Gaps Attackers are Still Exploiting","the-mfa-gaps-attackers-are-still-exploiting-f7a2a6","Attackers continue exploiting gaps in MFA coverage, using stolen credentials to access VPNs, RDP, and Windows systems that still rely on passwords alone. Specops explains why protecting cloud applications isn't enough and how organizations can close these authentication gaps. [...]","Attackers continue to exploit vulnerabilities in multi-factor authentication (MFA) by using stolen credentials to gain access to systems like VPNs and RDP that still rely solely on passwords. While organizations often secure cloud applications with MFA, internal systems may remain unprotected, creating a significant attack vector. This tactic was demonstrated in an Akira ransomware attack where initial access was gained through an unprotected VPN, leading to data theft.","Attackers exploit MFA gaps, using stolen credentials for VPNs and RDP access.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fthe-mfa-gaps-attackers-are-still-exploiting\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F10\u002F06\u002Fspecops-mfa-gaps.jpg","2026-10-13T14:01:11+00:00","2026-10-13T16:00:14.286147+00:00",8,[17,20,22,24,27,30],{"name":18,"type":19},"Microsoft 365","product",{"name":21,"type":19},"SonicWall SSL VPN",{"name":23,"type":19},"RDP",{"name":25,"type":26},"Active Directory","technology",{"name":28,"type":29},"Specops Software","vendor",{"name":31,"type":32},"Akira","threat_actor","2c8f44d4-b56e-47cf-9677-04f22c9ee78d",{"id":33,"icon":35,"name":36,"slug":37},null,"Identity & Access","identity-access",[39,41,46,51],{"category":40},{"id":33,"icon":35,"name":36,"slug":37},{"category":42},{"id":43,"icon":35,"name":44,"slug":45},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57],{"type":50,"value":31,"context":58},"Ransomware affiliate that exploited MFA gaps.",[28,18,21],{"controls":61,"vendors":142},[62,91,120],{"slug":63,"name":64,"problem":65,"products":66},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":92,"name":93,"problem":94,"products":95},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":121,"name":122,"problem":123,"products":124},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},[143],{"slug":144,"name":145,"logo_path":146,"roles":147},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[148],"reported_by",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":163},"mfa-gaps-in-internal-systems-leave-the-door-open-for-ransomware","MFA Gaps in Internal Systems Leave the Door Open for Ransomware","Organizations frequently deploy MFA for cloud and SaaS applications while leaving critical internal systems like VPNs and RDP protected only by passwords — a dangerous inconsistency attackers actively exploit. The Akira ransomware group demonstrated this gap by gaining initial access through a VPN endpoint with no MFA enforced, enabling credential-based intrusion that led to data theft. This highlights a common misconception that MFA coverage is 'good enough' when only partially deployed. Incomplete security controls create shadow attack surfaces that are just as dangerous as having no controls at all. A consistent, organization-wide MFA policy is essential to closing these gaps before adversaries exploit them.",[154,155,156,157,158,159,160,161,162],"CIS Control 6.3 – Require MFA for all user accounts","CIS Control 12.6 – Use of Secure Network Management and Communication Protocols","NIST SP 800-63B – Digital Identity Guidelines (AAL2\u002FAAL3 MFA requirements)","NIST AC-17 – Remote Access Controls","NIST IA-2(1) – Multi-Factor Authentication for Privileged and Non-Privileged Accounts","NIST CSF PR.AC-7 – Users, devices, and other assets are authenticated","MITRE ATT&CK T1078 – Valid Accounts (Initial Access)","MITRE ATT&CK T1133 – External Remote Services","GDPR Article 32 – Security of Processing (appropriate technical measures)",{}]