One Missing MFA Control Lets Credential Spray Become Full Akira Ransomware Intrusion

A single missing multi-factor authentication (MFA) control turned a basic credential-spraying attempt into a near-complete Akira ransomware intrusion in early August 2026.

The incident shows how quickly an exposed VPN can become the starting point for domain-wide reconnaissance, data theft, defence evasion, and ransomware deployment.

Akira remains one of the most active ransomware operations, with affiliates repeatedly abusing VPN services that lack MFA.

Their common playbook is direct: obtain valid remote-access credentials, move through the Windows domain, steal data, and encrypt systems.

Akira operators have also been widely observed using valid VPN accounts, Active Directory discovery, RDP, remote-management tools, and archive utilities during intrusions.sophos+1

Missing MFA Enables Akira

The intrusion began at approximately 03:45 UTC on August 4. SonicWall SSL VPN logs recorded failed sign-in attempts against multiple accounts from several external IP addresses.

This was a credential spray: attackers try a small set of passwords across many usernames to avoid lockouts and detection.

At 03:52 UTC, one attempt succeeded. The compromised VPN account had no MFA protection, giving the operator immediate remote access without a second verification challenge.

Nearly two hours later, the attacker used RDP to access the domain controller. They launched an elevated command prompt, checked connectivity with ping, and started Active Directory reconnaissance through PowerShell. Two files, AdUsers.txt and AdComp.txt, were created under C:\ProgramData\.

The user export collected detailed account information, including group memberships, password-change times, logon history, job titles, email addresses, phone numbers, and mailbox-related fields.

The computer export mapped systems across the domain, including hostnames, operating systems, IP addresses, service principal names, and recent logon data.

This activity gave the attackers a clear view of privileged users, possible lateral-movement paths, and systems likely to contain valuable data.

Active Directory enumeration and RDP-based lateral movement are established elements of Akira operations.

The attackers then moved to an application server and installed WinRAR. They used it to archive files from mapped shares before sending the staged data to an attacker-controlled S3 bucket with s5cmd.

This is double extortion: the group can threaten to leak stolen data even if the victim restores encrypted systems from backups.

Before launching ransomware, the affiliate installed AnyDesk as a Windows service and used an inbound session for interactive control and payload delivery.

AnyDesk and WinRAR are legitimate tools, but Akira operators have repeatedly abused both to blend malicious activity with normal administrative software.

The unusual part of this incident came at 06:29 UTC, when the attacker launched msconfig.exe and rebooted the host into Safe Mode with Networking, huntress said.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR