https://pwn.watch/t/jumpcloud Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 20 Jul 2023 00:00:00 GMT https://pwn.watch/i/jumpcloud-nation-state-breach-2023 https://pwn.watch/i/jumpcloud-nation-state-breach-2023 Thu, 20 Jul 2023 00:00:00 GMT high <p>A spear-phishing attack let a nation-state actor into JumpCloud's infrastructure. The attacker abused its command framework to target a small set of customers. JumpCloud force-rotated all customer API keys, and researchers tied the attack to North Korea, aimed at crypto companies.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2023-07-20: SentinelOne links the intrusion infrastructure to North Korean APT activity (<a href="https://www.sentinelone.com/labs/jumpcloud-intrusion-attacker-infrastructure-links-compromise-to-north-korean-apt-activity/">source</a>)</li><li>2023-07-12: JumpCloud publishes incident details and indicators (<a href="https://jumpcloud.com/blog/security-update-incident-details">source</a>)</li><li>2023-07-05: JumpCloud rotates all customer API keys (<a href="https://jumpcloud.com/blog/security-update-incident-details">source</a>)</li></ul>