[jefc1111]

"The Library utilises numerous trusted partners for software development, IT maintenance, and other forms of consultancy" ... "this terminal server was protected by firewalls and virus software, but access was not subject to Multi-Factor Authentication (MFA)"

¯\_(ツ)_/¯

[the8472]

Occasionally malware groups do patch vulnerabilities to maintain exclusive control over the victim machines. But that wouldn't be my default expectation, so relying on virus software to provide security does not seem like a great idea.

[yard2010]

There are many attack vectors to bypass MFA, especially sms based MFA

[jefc1111]

True, but if you don't have it enabled / required then you're giving off signals of negligence which may extend into other vulnerabilities.