A reused password on an unused Colonial Pipeline VPN account let DarkSide operators authenticate on the first try. They received a trusted session, moved laterally, exfiltrated data, and deployed ransomware that forced a six-day shutdown of the 5,500-mile pipeline carrying 45 percent of East Coast fuel supplies. The company paid a $4.4 million ransom. CISA later confirmed the compromised account had no multi-factor requirement. Once the VPN tunnel existed, every subsequent action inherited that authenticated state. Verizon’s 2022 DBIR recorded stolen credentials as one of the top five actions in confirmed breaches that year.
Initial Access Through a Single Password
The attack began with a dormant VPN account whose password had been reused and exposed in a prior incident. The VPN accepted that password alone, issued a session, and placed the operators inside the network. Even if a time-based OTP or push had been in place, it would not have stopped this attack. Those factors can be intercepted, fatigued, or phished because they are not device-bound. A device-bound, phish-proof credential eliminates this class: the private key never leaves enrolled hardware and signatures are origin-bound — nothing to intercept, proxy, or replay.
Session Token Abuse After Authentication
After the VPN login succeeded, the operators needed no further interactive authentication. Lateral movement, data staging, and ransomware deployment all occurred inside the already-trusted session. No authentication control can retroactively protect a token that has already been issued. The credential failure at the VPN boundary created the position from which the token could be abused.
Closing the Credential Gap With Device-Bound Keys
Device-bound keys would have closed the credential phase at the VPN. The attacker would have needed the enrolled hardware itself to produce a valid signature; the password alone would have been worthless. That guarantee rests on the fact that the private key never leaves the hardware and each signature is bound to the exact origin requesting it. The prevention model therefore focuses on eliminating reusable secrets at every login boundary rather than attempting to detect misuse after the fact.
Passkeys and FIDO2 rely on the same asymmetric cryptography, yet they define only the login ceremony. They place no requirements on registration or recovery. In this case the VPN account had never been enrolled with any second factor. A passkeys-only rollout would not have changed that configuration. Full lifecycle coverage requires that no phishable factor appears during registration, device onboarding, authorisation, authentication, or decommissioning.
FAQ
Would a device-bound credential on the VPN account have blocked the Colonial Pipeline initial access?
Yes. A device-bound key enrolled on the VPN would have required the attacker to possess the enrolled hardware and the private key, which is impossible without physical access, and even then extremely difficult to achieve due to the security of the TPM or Secure Enclave. Thus, stopping the attack instantly.
Why did the absence of any second factor on one dormant account create such a large blast radius?
The VPN issued a session token after the single-factor login. That token granted access to internal resources without further authentication checks, allowing lateral movement and ransomware deployment inside the trusted context.
Could malware on an endpoint have stolen a device-bound key the same way it steals cookies?
No. The private key never leaves the hardware boundary. Malware running on the same device can abuse an active session after login, but it cannot export the key for use on a different machine.
How does the enrollment process itself become an attack surface when only passkeys are used for login?
If device onboarding still relies on an email OTP, SMS code, or push notification, an attacker who controls that channel can register their own authenticator. The new device then produces legitimate signatures for subsequent login requests.
What statistic from 2021 shows how common credential-based entry remains?
Verizon’s 2022 DBIR found that stolen credentials ranked among the top five actions in confirmed breaches and that credentials were the most commonly compromised data type in 42 percent of system-intrusion cases.
The same credential-driven entry vector has appeared in other remote-access incidents where a single password granted broad network position. Device-bound keys close this replay path by ensuring the initial login itself cannot succeed without the enrolled hardware.
