[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fid_8izjYut_ZSK3pmDxfVTNCyI9I8g_Fpypkc-D13tg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":48,"controls":49},"04402467-2dec-445a-a4e1-c15307c17a28","mfa-gaps-in-internal-systems-leave-the-door-open-for-ransomware","78122186-3812-48d4-87fb-cb290a12f22a","MFA Gaps in Internal Systems Leave the Door Open for Ransomware","Organizations frequently deploy MFA for cloud and SaaS applications while leaving critical internal systems like VPNs and RDP protected only by passwords — a dangerous inconsistency attackers actively exploit. The Akira ransomware group demonstrated this gap by gaining initial access through a VPN endpoint with no MFA enforced, enabling credential-based intrusion that led to data theft. This highlights a common misconception that MFA coverage is 'good enough' when only partially deployed. Incomplete security controls create shadow attack surfaces that are just as dangerous as having no controls at all. A consistent, organization-wide MFA policy is essential to closing these gaps before adversaries exploit them.","**Immediate actions:**\n- Audit all remote access points (VPN, RDP, SSH) and enforce MFA on every one without exception.\n- Disable or block any VPN or remote access service that cannot support MFA until a compliant solution is deployed.\n\n**Long-term improvements:**\n- Adopt a Zero Trust architecture that requires continuous verification for all users, devices, and systems regardless of network location.\n- Maintain a comprehensive inventory of all authentication-protected assets and enforce a unified MFA policy across cloud and on-premises systems.\n- Implement phishing-resistant MFA methods (e.g., FIDO2\u002Fpasskeys) to eliminate credential-based bypass techniques such as MFA fatigue and SIM swapping.\n\n**Detection measures:**\n- Monitor and alert on authentication attempts from unusual geolocations, off-hours logins, or repeated MFA push failures as indicators of credential stuffing or fatigue attacks.\n- Deploy SIEM rules to flag any successful VPN or RDP login that did not complete an MFA challenge.\n- Conduct quarterly access control reviews to identify systems where MFA has drifted out of compliance.",[12,13,14,15,16,17,18,19,20],"CIS Control 6.3 – Require MFA for all user accounts","CIS Control 12.6 – Use of Secure Network Management and Communication Protocols","NIST SP 800-63B – Digital Identity Guidelines (AAL2\u002FAAL3 MFA requirements)","NIST AC-17 – Remote Access Controls","NIST IA-2(1) – Multi-Factor Authentication for Privileged and Non-Privileged Accounts","NIST CSF PR.AC-7 – Users, devices, and other assets are authenticated","MITRE ATT&CK T1078 – Valid Accounts (Initial Access)","MITRE ATT&CK T1133 – External Remote Services","GDPR Article 32 – Security of Processing (appropriate technical measures)",{},"published","2026-10-13T16:21:32.131451+00:00","2026-10-13T16:21:32.111+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fthe-mfa-gaps-attackers-are-still-exploiting\u002F","the-mfa-gaps-attackers-are-still-exploiting-f7a2a6","The MFA Gaps Attackers are Still Exploiting",[30,36,42],{"id":31,"name":32,"slug":33,"description":34,"color":35},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":37,"name":38,"slug":39,"description":40,"color":41},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":43,"name":44,"slug":45,"description":46,"color":47},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[],[50,54,58],{"slug":51,"name":52,"problem":53},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":55,"name":56,"problem":57},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":59,"name":60,"problem":61},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up."]