JumpCloud breached by North Korean hackers to reach crypto customers
JumpCloud (directory / device management SaaS)
A spear-phishing attack let a nation-state actor into JumpCloud's infrastructure. The attacker abused its command framework to target a small set of customers. JumpCloud force-rotated all customer API keys, and researchers tied the attack to North Korea, aimed at crypto companies.
Why this severity: Identity/device-management SaaS compromise by a nation-state actor
- Started
- Jun 27, 2023
- Closed
- Jul 20, 2023
Affected
Not published yet
Fixed in
No fixed release yet
Updates by day4
▸Jul 20, 2023
Link #SentinelOne links the intrusion infrastructure to North Korean APT activity
Source
▸Jul 12, 2023
Link #JumpCloud publishes incident details and indicators
Source
▸Jul 5, 2023
Link #JumpCloud rotates all customer API keys
Source
▸Jun 27, 2023
Link #JumpCloud finds anomalous activity on an internal orchestration system
Source
Advisories1
News & write-ups1
Get an email when a new major security incident drops. No spam, unsubscribe any time.
