The Dangers of Storing Unencrypted Passwords

Huntress SOC investigated a SonicWall VPN compromise that enabled Akira ransomware execution and the placement of rogue systems without EDR coverage; attackers located plaintext Huntress recovery codes on an engineer's desktop, used them to log into the Huntress portal from 104.238.221.69 to suppress alerts and uninstall agents, and exported a certificate PFX—demonstrating MFA bypass, credential theft, and attempts to disable detection and persist.