# Plain Text Passwords: The Risks of Storing Them

Akira actors on a SonicWall-compromised network found plaintext Huntress recovery codes on an engineer's desktop, used them to bypass MFA, close alerts and uninstall EDR agents.

- Payout: Real-world hack
- Severity: high
- Program: Huntress
- Analysis by: Huntress
- Disclosed: 2026-07-06
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/dangers-of-storing-unencrypted-passwords
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-dangers-of-storing-unencrypted-passwords
- Tags: area:cloud domain:infra impact:ato impact:integrity impact:internal-access kind:incident platform:threat-intel sev:high tech:windows technique:recon vuln:access-control vuln:mfa-bypass vuln:secrets-leak

**Target:** Huntress MDR portal account of a security engineer, reached via internal admin share
**Root cause:** Huntress recovery codes (MFA bypass backup credentials) were stored in a plaintext .txt file on a security engineer's desktop, readable over the internal admin share c$.
**Steps:**
1. Attacker gains initial access via compromised SonicWall VPN, appearing as internal 192.168.x.x traffic without EDR agents.
2. Enumerate administrative shares from the DC and open the file: `"C:\windows\system32\NOTEPAD.EXE" \\192.168.1.51\c$\Users\<redacted>\Desktop\Huntress_recovery_codes-<redacted>.txt`
3. Use the recovery codes to log into the Huntress portal as the security engineer from 104.238.221[.]69, bypassing MFA.
4. Close active incident reports to suppress visibility and task de-isolation/removal of Huntress agents from compromised hosts.
**How found:** Huntress SOC noticed a security engineer account anomalously resolving active incident reports during an ongoing compromise; partner confirmed the engineer had not done it, and portal logs tied the logon to known-malicious IP 104.238.221[.]69.
**Exploitation:** After SonicWall VPN compromise and Akira ransomware deployment, the actor read the recovery-code file over the admin share, authenticated to the Huntress portal with those codes (no MFA challenge), then manually resolved incident reports and requested agent uninstalls to blind detection while continuing encryption.
**Escalation:** Pivoted from a compromised VPN foothold to a third-party security console, converting a desktop text file into control over the victim's EDR management plane.
**Insight:** Recovery/backup codes are MFA-bypass credentials: hunt for them in desktop files, shares and configs reachable via admin shares (c$), and treat anomalous 'remediation' actions inside security consoles as a defense-evasion signal rather than routine admin work.

## Proof of concept (copied exactly from the original report)

**Notepad opening plaintext recovery codes file over admin share**

```
"C:\windows\system32\NOTEPAD.EXE" \\192.168.1.51\c$\Users\<redacted>\Desktop\Huntress_recovery_codes-<redacted>.txt
```

**certutil export of certificate private key to PFX**

```
certutil -exportPFX 1d967729be08ef8c4bf86874c9542b4e C:\temp\cert.pfx

certutil -exportPFX 1d967729be08ef8c4bf86874c9542b4e C:\cert.pfx
```