# JumpCloud breached by North Korean hackers to reach crypto customers · pwn.watch

> A spear-phishing attack let a nation-state actor into JumpCloud's infrastructure. The attacker abused its command framework to target a small set of customers. JumpCloud force-rotated all customer API keys, and researchers tied the attack to North Korea, aimed at crypto companies.

Page: https://pwn.watch/i/jumpcloud-nation-state-breach-2023 · generated 2026-10-22T21:47:37.879Z

## Status
- Severity: high · status: closed · patch: no-fix-needed
- Product: JumpCloud (directory / device management SaaS)
- Started: 2023-06-27 · closed: 2023-07-20

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/jumpcloud-nation-state-breach-2023/feed.xml
- JSON Feed: https://pwn.watch/i/jumpcloud-nation-state-breach-2023/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/jumpcloud-nation-state-breach-2023.json
- This file: https://pwn.watch/i/jumpcloud-nation-state-breach-2023/llms.txt

## Updates (newest first)
- 2023-07-20: SentinelOne links the intrusion infrastructure to North Korean APT activity (https://www.sentinelone.com/labs/jumpcloud-intrusion-attacker-infrastructure-links-compromise-to-north-korean-apt-activity/)
- 2023-07-12: JumpCloud publishes incident details and indicators (https://jumpcloud.com/blog/security-update-incident-details)
- 2023-07-05: JumpCloud rotates all customer API keys (https://jumpcloud.com/blog/security-update-incident-details)
- 2023-06-27: JumpCloud finds anomalous activity on an internal orchestration system (https://jumpcloud.com/blog/security-update-incident-details)

## Fix brief
# Security brief: JumpCloud breached by North Korean hackers to reach crypto customers

Source: https://pwn.watch/i/jumpcloud-nation-state-breach-2023 · status: closed (closed Jul 20, 2023) · severity: high · updated Jul 20, 2023

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
A spear-phishing attack let a nation-state actor into JumpCloud's infrastructure. The attacker abused its command framework to target a small set of customers. JumpCloud force-rotated all customer API keys, and researchers tied the attack to North Korea, aimed at crypto companies.

Severity detail: Identity/device-management SaaS compromise by a nation-state actor

- Product: JumpCloud (directory / device management SaaS)

## Affected versions
- Not specified in the data. Check the advisories below.

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Jul 20, 2023: SentinelOne links the intrusion infrastructure to North Korean APT activity
- Jul 12, 2023: JumpCloud publishes incident details and indicators
- Jul 5, 2023: JumpCloud rotates all customer API keys
- Jun 27, 2023: JumpCloud finds anomalous activity on an internal orchestration system

## Advisories
- [Security Update: Incident Details](https://jumpcloud.com/blog/security-update-incident-details) (JumpCloud)

## Write-ups & news
- [JumpCloud Intrusion: Attacker Infrastructure Links Compromise to North Korean APT Activity](https://www.sentinelone.com/labs/jumpcloud-intrusion-attacker-infrastructure-links-compromise-to-north-korean-apt-activity/)

---
Machine-readable: https://pwn.watch/i/jumpcloud-nation-state-breach-2023.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.