- Published
- Source
- BleepingComputer
- Filed under
- Identity, Malware & exploits
Attackers continue exploiting gaps in MFA coverage, using stolen credentials to access VPNs, RDP, and Windows systems that still rely on passwords alone. Specops explains why protecting cloud applications isn't enough and how organizations can close these authentication gaps.
Protecting sign-ins
- Phishing-resistant multi-factor authentication – passkeys or security keys – for administrators first.
- Block the old sign-in methods that skip MFA, and review who can grant apps access to your data.
- Alert on impossible travel, newly added MFA methods and unusual consent grants.
More helpNCSC: multi-factor authentication for online services (opens in a new tab)
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
External Remote Services
Persistence, Initial AccessWhat a defender checks
- List every VPN, remote desktop and remote-access gateway you expose.
- Require MFA on all of them, and keep them patched.
- Alert on sign-ins from new countries, networks or devices.
Build the skillBlue Team Engineer · Network Security Engineering
Valid Accounts
Stealth, Persistence, Privilege Escalation, Initial AccessWhat a defender checks
- Review risky sign-ins: impossible travel, new devices, unusual locations.
- Reset credentials and revoke sessions for affected accounts.
- Put phishing-resistant MFA on admin accounts first.
Build the skillBlue Team Analyst · Identity & Access Monitoring
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Microsoft SC-300 exam training
Most attacks start with an identity. Learn to defend it.
Tutor-led SC-300 preparation: Microsoft Entra ID, authentication and Conditional Access, workload and application identities, and identity governance with access reviews and Privileged Identity Management.
- Entra ID and hybrid identity
- Conditional Access and authentication
- Access reviews and PIM
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
