“For initial access, Akira ransomware’s operators have been targeting VPN services that lacked multi-factor authentication, mainly using known vulnerabilities in Cisco products (such as CVE-2020-3259 and CVE-2023-20269).”
Akira hit more than 250 organizations and collected over $42 million since early 2023. The way in was a VPN with no MFA and a Cisco bug with a CVE from 2020. Four agencies wrote the advisory. Every victim had a patch available and a box left unticked.