Healthcare providers, schools, and government agencies faced increasing ransomware threats starting in May 2023 when 8base operators began their campaigns. The average cost of a data breach reached $4.88 million in 2024, with attackers routinely bypassing deployed multi-factor protections to reach backup systems and administrative consoles. In the 8base campaigns, initial access consistently came from stolen or guessed credentials for VPNs, remote desktops, and portals. Once authenticated, operators enumerated networks, located backup infrastructure, and exfiltrated data before encryption.
The organizations already used multi-factor authentication, yet the second factors remained SMS codes or push notifications. Attackers obtained the first factor through credential stuffing or phishing messages that mimicked IT support. They then captured one-time codes or solicited real-time approval of fraudulent push requests, completing the login sequence from their own systems. No further passwords were needed for lateral movement.
Credential Access as the Persistent Entry Point
Traditional second factors introduce secrets or approval actions that travel outside the primary device. When those secrets can be intercepted or approved under false pretenses, the authentication decision still succeeds from the attacker’s perspective. The 8base incidents illustrate this pattern across multiple victims: the presence of MFA did not prevent session establishment because the factors themselves remained phishable or relayable.
Credential reuse and centralized storage compound the exposure. A single compromised password paired with an interceptable second factor grants broad access without triggering additional controls at the point of entry.
Device-Bound Public-Key Cryptography Changes the Model
Public-key cryptography tied to the endpoint removes reusable or out-of-band secrets. A private key is generated and stored locally on the user’s device; the corresponding public key is registered with the service. Each authentication produces a fresh cryptographic signature over a server-issued challenge. No value that can be captured, replayed, or socially engineered travels across the network.
Because the credential never leaves the device, no separate token or phone is required for verification. The same cryptographic binding applies during registration, device onboarding, authorization, and decommissioning, so no phishable material is introduced at any stage.
MFA 2.0 as Prevention Across the Full Lifecycle
MFA 2.0 follows this approach exactly: phish-proof, passwordless authentication built on public-key cryptography. It uses device-bound credentials with no central database of secrets and performs same-device verification without requiring a second device. The core principle is prevention. When no credential exists that can be stolen or approved under false pretenses, the initial authenticated session required for enumeration and lateral movement never occurs.
This model extends beyond the login step. FIDO2 already applies public-key cryptography to authentication, yet many deployments retain phishable factors during enrollment or recovery. MFA 2.0 maintains the same cryptographic standard across registration, device binding, authorization decisions, and decommissioning so that no weak link appears in the identity chain.
Existing systems can adopt this approach by replacing vulnerable second factors rather than layering detection on top of them. Without credentials or approval mechanisms that can be captured or manipulated, the access patterns observed in the 8base campaigns are structurally eliminated before any ransomware operator reaches the network.
