According to CISA's May 2022 alert, the Conti group reached Costa Rican government networks through compromised credentials that let them authenticate directly to remote access portals. Once those credentials succeeded, the attackers held live session tokens and needed nothing more to operate inside the environment.
The attackers used those credentials to authenticate. Once the login completed, the session was live. Any legacy one-time code or push notification would have been irrelevant at that stage because the authentication event had already occurred. The credential itself was the only control that mattered, and it was no longer in play after the first successful sign-in.
Government environments often rely on shared remote access portals or VPNs protected only by passwords or simple second factors. When those credentials are obtained through phishing or reuse, the attacker authenticates exactly as a legitimate user would. The session token issued afterward carries the same rights without any device-bound check on subsequent requests.
What the Stolen Tokens Enabled Next
After the initial login, attackers harvested or replayed session tokens to reach additional systems. Token theft at this stage is a post-authentication problem. The malware or process that captured the token already ran with the same privileges as the authenticated user, so no login factor could have blocked the extraction.
From there the attackers deployed ransomware across agencies. Each new system they reached accepted the existing token or a fresh one derived from the compromised account. No origin-bound signature or hardware check forced a new proof of possession. The blast radius grew because one authenticated session granted access to multiple connected government services.
This pattern matches the DBIR observation that stolen credentials remain the dominant initial vector while later movement often relies on tokens that require no additional authentication. In the Costa Rica case the second phase succeeded precisely because the tokens carried forward the rights established in phase one.
Why Government Systems Amplified the Damage
Public sector networks frequently connect multiple agencies through shared identity providers. A single valid session therefore opens doors that would otherwise stay separate. Conti exploited that connectivity once the first credential worked.
The attack produced extended operational outages. Recovery required rebuilding trust in every affected system because the tokens had allowed broad lateral movement. According to the same CISA alert, the incident affected multiple ministries and forced manual processes for weeks.
The same credential compromise pattern appears in other documented incidents involving government and critical infrastructure targets. Each case shows that once a session token exists, the attacker operates inside the trust boundary.
A device-bound signature that never leaves the enrolled hardware would have made the initial credential useless for authentication. The device-bound architecture makes that boundary concrete.
FAQ
How did Conti initially access Costa Rica government systems?
The Conti group obtained valid credentials that allowed direct authentication to government portals and remote access services. Once those credentials worked, the attackers received live session tokens that required no further verification.
Would any form of legacy MFA have stopped the initial breach?
Yes. The attack was pure credential theft and a one-time code or push notification would have stopped it. However, it does not mean that the one-time code or push cannot be captured in real time would. Since, it is very common to capture a one-time code or push in real time, it would have still produced a valid session token for the attacker to use afterward.
Why could the attackers move between agencies so easily?
After the first successful login, session tokens or derived access grants carried the user's rights across connected systems. No additional authentication boundary existed once the initial token was issued.
What made the ransomware deployment possible without further logins?
The attackers used the stolen tokens to reach file shares, management consoles, and deployment points. Each of those resources accepted the existing authenticated context rather than demanding a new hardware-backed signature.
Could device-bound credentials have changed the outcome?
Yes for the first phase. A private key that never leaves the enrolled hardware and produces origin-specific signatures would have made the initial credential theft useless for authentication. The second phase could also have been prevented by removing SSO and using secure-explicit sign-on (SES).
The full technical breakdown of what actually works is at mfa2point0.com.
