North Korean hackers behind JumpCloud attack

According to cybersecurity company SentinelOne, the cyberattack on JumpCloud, specializing in directory, identity, and access management, can be traced back to North Korean advanced persistent threat (APT) activity. 

The attack began with a spear-phishing email campaign on June 22, followed by data injection into JumpCloud’s commands framework a few weeks later.

The findings come from @SentinelOne which mapped out the infrastructure pertaining to the intrusion to uncover underlying patterns. It's worth noting that JumpCloud, last week, attributed the attack to an unnamed "sophisticated nation-state sponsored threat actor."

— FastFoodRembrandt.onion (@solminingpunk) July 20, 2023

The attack was highly sophisticated and targeted, focusing on a specific group of JumpCloud’s customers. Although the company did not disclose the exact number of impacted customers or the type of compromised data, it serves over 180,000 organizations.

JumpCloud responded promptly to the incident by implementing its incident response plan, mitigating the threat, securing its network, and communicating with affected customers. Law enforcement was also engaged to assist in the investigation.

What happened next?

After analyzing the indicators of compromise (IoCs) shared by JumpCloud, SentinelOne identified connections to North Korean state-sponsored activities. These IoCs helped the cybersecurity firm identify the attackers’ infrastructure, which displayed patterns consistent with previous North Korean campaigns.

The attack demonstrated North Korean threat actors’ continuous efforts to adapt and employ new methods to infiltrate targeted networks. The intrusion into JumpCloud’s system illustrated their preference for supply chain targeting, which can lead to multiple subsequent intrusions.

Highly confident in attributing the JumpCloud intrusion IOCs to North Korean threat actors. #Lazarus Group APT at a high level, but we may be able to get more specific if the malware ever goes public.

Blog includes new IOCs/context:https://t.co/hs56ogqkPy #ThreatIntel pic.twitter.com/n89GonVqZN

— Tom Hegel (@TomHegel) July 20, 2023

Mandiant, while investigating a downstream victim of the attack, also linked the incident to a North Korean threat actor. This particular actor, believed to be associated with the DPRK’s Reconnaissance General Bureau (RGB), primarily focuses on financially motivated cyber activities, mainly targeting the cryptocurrency industry and blockchain platforms. 

Source: NSA

The blending and sharing of North Korea’s cyberinfrastructure make attribution challenging, but their consistent targeting approach suggests other victims may also be affected by similar attacks in the cryptocurrency sector.

Concluding thoughts: APT attacks are the next major threat

Advanced persistent threats, undetected yet devastating, are the sophisticated cyber attacks planned to do the most damage. 

North Korean threat actors consistently adopt methods to infiltrate precious data through various methods.

Best security practices for organizations and individuals are necessary to be safe and secure.