JBS Paid $11M After One Set of Remote Access Credentials Worked

REvil obtained valid credentials for JBS remote access portals and used them to reach internal networks. From that foothold the attackers moved laterally, exfiltrated data, and encrypted servers that controlled production lines. Plants in multiple countries stopped processing meat for several days. JBS later confirmed payment of $11 million in cryptocurrency to obtain decryption keys. The incident followed a pattern documented in Verizon's 2022 DBIR: 82 percent of breaches involved the human element, with stolen credentials ranking among the top five actions.

How Stolen Credentials Gave REvil Direct Access to JBS Systems

The attackers presented valid username-password pairs to remote access systems and succeeded on the first attempt. Even if a time-based OTP or push had been in place, it would not have stopped this attack. These factors can be intercepted, fatigued, or phished because they are not device-bound. A device-bound, phish-proof credential eliminates this class: the private key never leaves enrolled hardware and signatures are origin-bound — nothing to intercept, proxy, or replay.

After the first login the attackers harvested session tokens and existing administrative rights. Lateral movement and ransomware deployment required no new interactive authentication. The malware ran with the same memory access as the authentication system itself. The authentication question begins at the next phase: lateral movement. Stolen tokens required no further authentication, so any control placed only at the front door would have been irrelevant once the attackers were inside. According to the 2022 DBIR, 40 percent of ransomware incidents involved desktop-sharing software. JBS matches that statistic exactly: the absence of any authentication barrier after the initial credential use turned a remote access compromise into a multi-continent production outage.

Device-Bound Signatures Would Have Blocked the Initial Foothold

Device-bound keys close the initial access path that enabled later session theft. Every authentication request must be signed by a private key that never leaves the enrolled hardware. Thus, an attacker cannot produce a valid signature because they lack the hardware that holds the key. The remote access portal would have rejected the login attempt outright. Once inside, the attackers relied on reusable session material. Device-bound credentials do not eliminate post-authentication token theft, but they raise the bar for reaching that stage. The only way to obtain a fresh signature is to possess the enrolled device itself. That requirement removes the remote credential-harvesting route that JBS experienced. The 2022 DBIR notes that credentials were the most commonly compromised data type in system intrusion breaches. Removing the ability to turn a stolen credential into an authenticated session directly addresses the entry vector observed at JBS.

Full Lifecycle Protection Closes Enrollment Weaknesses

FIDO2 and passkeys rely on asymmetric cryptography. During registration the device generates a key pair; the public key is stored by the service while the private key remains inside hardware such as a TPM or secure enclave. Each authentication produces a signature that includes the origin of the request. This mechanism is phishing-resistant for the authentication step itself. However, the standard defines only the login act. It does not dictate how a new device is registered or how recovery occurs. When those steps still rely on email OTPs, SMS codes, or push notifications, an attacker who controls the phishable factor can enroll their own hardware and receive legitimate-looking signatures thereafter.

In the JBS case a passkeys-only rollout that still used email or SMS for initial account creation or device enrollment would have left the same remote access systems exposed. An attacker who obtained the enrollment factor could register their own device, after which every signature it produced would appear valid to the service. MFA 2.0 removes phishable factors from every stage: registration, device onboarding, authorisation, authentication, and decommissioning. Without that full-lifecycle coverage, the cryptographic strength of the login step alone cannot close the path taken against JBS. Device-bound keys close this replay path only when the same boundary applies from the first user registration onward. The device-bound architecture enforces this boundary across the lifecycle.

FAQ

Would device-bound credentials have prevented the initial JBS breach?

Yes. The REvil operators used stolen remote access credentials to obtain the first authenticated session. Device-bound keys require a hardware signature that cannot be produced from a stolen password alone, so the login would have failed.

Did later lateral movement at JBS require additional logins?

No. After the initial credential use, attackers harvested session tokens and used existing administrative rights. Stolen tokens required no further authentication, which is why controls limited to the front door could not affect the ransomware deployment phase.

How does MFA 2.0 differ from standard passkey deployments at enrollment?

Standard passkey deployments often retain email OTP or SMS for account creation and device onboarding. MFA 2.0 uses no phishable factor at any lifecycle stage, so an attacker who compromises an enrollment channel cannot register their own device and obtain valid signatures.

What production impact did the JBS attack actually cause?

The ransomware halted operations at plants across the United States, Australia, and Canada. JBS stated that global beef, pork, and poultry processing was disrupted for several days before systems were restored.

Why did JBS pay the ransom so quickly?

JBS confirmed payment of $11 million in cryptocurrency to obtain decryption keys and limit further operational damage across multiple continents.