On August 4, 2026, an Akira ransomware affiliate began spraying passwords against a SonicWall SSL VPN. Around seven minutes later, one attempt succeeded. The credentials were valid, and the VPN account had no multi-factor authentication (MFA) protecting it. Roughly two hours later, the attacker used RDP to access the domain controller and began enumerating Active Directory.
The ransomware deployment ultimately failed, but by then the attacker had already stolen credentials and file-share data.
It highlights an issue that is still common in 2026, where an organization might require MFA for Microsoft 365 and other SaaS applications while leaving certain access paths protected only by passwords. It’s this gap that attackers are regularly exploiting.
Stolen Credentials Remain a Valuable Tool for Attackers
Once an attacker has a valid account, they can begin interacting with the environment through the same authentication mechanisms used by legitimate employees and administrators. AI is adding another dimension to this problem by helping attackers operate at greater speed and scale.
The underlying identity tactics are largely unchanged: attackers still compromise identities, reuse credentials, escalate privileges and misuse legitimate access. The threat is that AI makes familiar techniques cheaper and easier to run at scale.