“The Enterprise Wi-Fi network, however, did not require MFA and only required a user’s valid domain username and password to authenticate.”
APT28 password-sprayed a public service that had MFA, then used the validated credentials on the Wi-Fi network that didn’t. To get in range from thousands of miles away, it breached neighbouring organizations and hijacked dual-homed laptops with Wi-Fi adapters. The neighbour’s own VPN had no MFA either. A third neighbour declined to hand over the data needed to finish the investigation. Your security perimeter now includes the tenants next door.