Introduction
The shift to remote and hybrid work has made Virtual Private Networks (VPNs) indispensable for secure connectivity. Yet, VPNs without Multi-Factor Authentication (MFA) have become one of the most exploited attack vectors in recent years. Cybercriminals know that if they compromise a single set of credentials, they can often gain unrestricted access to sensitive systems, bypassing traditional perimeter defenses.
In this blog, we’ll explore why VPNs without MFA are increasingly vulnerable, how MFA strengthens your defenses, why layered security is critical, and how incident response (IR) planning can mitigate damage when attacks occur. We’ll also touch on compliance standards that mandate MFA and why failing to implement it could cost your organization more than just a breach.
The Surge in VPN Attacks Without MFA
VPNs were designed to provide secure remote access, but they rely heavily on user credentials. Unfortunately, usernames and passwords are easy prey for attackers through phishing, credential stuffing, and dark web marketplaces.
Why VPNs are vulnerable:
- Single point of entry: VPNs often serve as a gateway to the entire corporate network.
- Credential-based attacks: If attackers obtain valid credentials, they can bypass most traditional defenses.
- Legacy protocols: Older VPN configurations often lack modern encryption and authentication safeguards.
Recent trends:
- According to industry reports, 56% of organizations experienced VPN-related breaches in the past year, and ransomware attacks tied to VPN vulnerabilities surged by 28%.
- Credential stuffing attacks have increased dramatically, with billions of stolen credentials circulating on the dark web.
Attackers prefer VPNs without MFA because they only need a username and password—making these systems low-hanging fruit for IR attacks and ransomware campaigns.
Real-World Examples of VPN Exploitation
To demonstrate that these risks aren’t theoretical, here are two recent incidents:
1. Cisco VPNs Without MFA Targeted by Akira Ransomware
Cisco confirmed that the Akira ransomware group has been actively targeting organizations using Cisco VPNs without MFA. Attackers leveraged brute-force and credential-stuffing techniques to gain initial access, then moved laterally using tools like AnyDesk and LSASS dumps to escalate privileges and deploy ransomware. Cisco’s Product Security Incident Response Team emphasized that enabling MFA could have prevented these breaches. [threatdown.com]
2. SonicWall SSL VPNs Breached Even With MFA
In a more alarming twist, Akira ransomware operators have successfully bypassed MFA protections on SonicWall SSL VPNs. Despite patches and OTP-based MFA being deployed, attackers exploited an improper access control vulnerability (CVE-2024-40766) and likely harvested OTP seeds during earlier campaigns. This allowed them to authenticate even against MFA-protected accounts, proving that MFA alone isn’t enough without proper patching and monitoring.
Why MFA Is Critical
Multi-Factor Authentication adds an extra layer of security by requiring something beyond a password—such as a one-time code, biometric verification, or a hardware token.
Benefits of MFA:
- Stops credential-based attacks: Even if credentials are stolen, MFA makes unauthorized access significantly harder.
- Aligns with compliance frameworks:
- NIST and CISA strongly recommend MFA for remote access.
- PCI DSS 4.0, HIPAA, and ISO 27001 include MFA requirements for compliance.
- Many cyber insurance providers now mandate MFA for coverage.
- Supports Zero Trust principles: MFA is foundational for modern security models like Zero Trust Network Access (ZTNA) and Secure Access Service Edge (SASE).
Failing to implement MFA can lead to non-compliance, higher insurance premiums, and increased risk of IR attacks.
Layered Security—Defense in Depth
While MFA is powerful, it’s not a silver bullet. Cybersecurity best practices call for defense in depth, or layered security.
What is layered security?
It’s the combination of multiple controls—technical, administrative, and physical—to reduce risk.
Why it matters:
- No single solution is foolproof.
- If one layer fails (e.g., VPN credentials are compromised), others can prevent escalation.
Examples of layers:
- MFA for remote access
- Endpoint Detection and Response (EDR)
- Network segmentation
- Continuous monitoring and anomaly detection
- Regular patching and vulnerability management
Layered security ensures that even if attackers breach one control, they encounter additional barriers—buying time for detection and response.
Incident Response and IR Attacks
Even with MFA and layered security, breaches can happen. That’s why incident response (IR) planning is essential.
Why IR matters:
- Cyberattacks are increasingly sophisticated, often involving multiple stages and persistence mechanisms.
- Ransomware campaigns frequently exploit VPN vulnerabilities as an initial foothold.
Key elements of IR planning:
- Preparation: Define roles, responsibilities, and escalation paths.
- Detection: Implement monitoring tools to identify anomalies quickly.
- Containment: Isolate affected systems to prevent lateral movement.
- Eradication and Recovery: Remove malicious artifacts and restore operations securely.
- Lessons Learned: Update policies and controls based on post-incident analysis.
Organizations with robust IR plans recover faster and reduce financial and reputational damage.
Compliance and Cyber Insurance
Implementing MFA isn’t just about security—it’s about meeting regulatory and contractual obligations.
Compliance frameworks requiring MFA:
- NIST SP 800-63: Strongly recommends MFA for remote access.
- PCI DSS 4.0: Requires MFA for all administrative access and remote access to cardholder data.
- HIPAA: Encourages MFA for systems containing protected health information (PHI).
- ISO 27001: Calls for strong authentication controls, including MFA.
Cyber insurance providers increasingly require MFA for coverage eligibility. Failure to comply can result in denied claims or higher premiums.
Practical Steps for Businesses
- Implement MFA everywhere: VPN, cloud apps, email, and privileged accounts.
- Audit VPN configurations: Disable legacy protocols and enforce strong encryption.
- Consider ZTNA or SASE: Move beyond traditional VPNs for granular access control.
- Train employees: Phishing awareness and credential hygiene remain critical.
- Develop an IR plan: Prepare for worst-case scenarios with clear processes and tools.
Conclusion
VPNs without MFA are an open invitation to attackers. MFA is not just a checkbox—it’s a critical safeguard against modern threats and a compliance requirement for many industries. When combined with layered security and a robust incident response strategy, MFA helps create a resilient defense that protects your organization from evolving cyber risks.
Start with MFA today—your compliance, insurance, and peace of mind depend on it. Learn more about how FusionTek helps our clients stay protected.
