MFA Gaps in Internal Systems Leave the Door Open for Ransomware
Organizations frequently deploy MFA for cloud and SaaS applications while leaving critical internal systems like VPNs and RDP protected only by passwords — a dangerous inconsistency attackers actively exploit. The Akira ransomware group demonstrated this gap by gaining initial access through a VPN endpoint with no MFA enforced, enabling credential-based intrusion that led to data theft. This highlights a common misconception that MFA coverage is 'good enough' when only partially deployed. Incomplete security controls create shadow attack surfaces that are just as dangerous as having no controls at all. A consistent, organization-wide MFA policy is essential to closing these gaps before adversaries exploit them.
Tactical Insight
Immediate actions
- Audit all remote access points (VPN, RDP, SSH) and enforce MFA on every one without exception.
- Disable or block any VPN or remote access service that cannot support MFA until a compliant solution is deployed.
Long-term improvements
- Adopt a Zero Trust architecture that requires continuous verification for all users, devices, and systems regardless of network location.
- Maintain a comprehensive inventory of all authentication-protected assets and enforce a unified MFA policy across cloud and on-premises systems.
- Implement phishing-resistant MFA methods (e.g., FIDO2/passkeys) to eliminate credential-based bypass techniques such as MFA fatigue and SIM swapping.
Detection measures
- Monitor and alert on authentication attempts from unusual geolocations, off-hours logins, or repeated MFA push failures as indicators of credential stuffing or fatigue attacks.
- Deploy SIEM rules to flag any successful VPN or RDP login that did not complete an MFA challenge.
- Conduct quarterly access control reviews to identify systems where MFA has drifted out of compliance.