North Korean state-sponsored hacking group Labyrinth Chollima gained access to command framework of US cloud directory provider JumpCloud beginning on 22 June 2023 · 22.06.2023
A state-sponsored threat actor gained access to the command framework of US cloud directory provider JumpCloud beginning on 22 June 2023, the company reported in a notice on its website on 12 July 2023.
On 27 June, JumpCloud discovered unusual activity in a specific area of its IT infrastructure that the company traced back to a spear-phishing approach five days earlier. On 5 July, JumpCloud became aware that suspicious activity had permeated to the command frameworks of a few customers.
On 20 July, the senior threat researcher at SentinelOne, Tom Hegel, attributed this cyber incident to a state-sponsored hacking group from North Korea.
A day later, on 21 July, Reuters published a media report based on findings from the previous day. Initially, Mandiant also attributed this cyber incident to a state-sponsored hacking group from North Korea working for the Reconnaissance General Bureau (RGB), North Korea's military intelligence agency. CrowdStrike went a step further and attributed this cyber incident to the state-sponsored hacking group Labyrinth Chollima, or better known as Lazarus. In addition, anonymous sources said that the previously unknown customers of JumpCloud who had been targeted were cryptocurrency companies.
On 24 July, Mandiant published a technical report on the investigation of one of the affected victims. In this technical report, Mandiant attributed this cyber incident to the North Korean state-sponsored hacking group UNC4889, which is affiliated with the Reconnaissance General Bureau (RGB). UNC4889 focuses on cryptocurrency companies and overlaps with the North Korean cybercriminal hacking group APT43, which also works for the North Korean government.
Sources cited by EuRepoC (24)
Show 19 more
North Korea Leverages SaaS Provider in a Targeted Supply Chain Attack · 2023-07
North Korea Leverages SaaS Provider in a Targeted Supply Chain Attack
https://www.mandiant.com/resources/blog/north-korea-supply-chain
Targeting of IT company as part of a supply-chain attack · Jul 2023
North Korean threat actors targeted the systems of an information technology firm, JumpCloud. After gaining access to JumpCloud’s systems, the operators targeted several JumpCloud customers involved in the cryptocurrency trade.
JumpCloud · July 20, 2023
Date:: July 20, 2023; Attribution:: TraderTraitor / Jade Sleet. "Mandiant attributed these intrusions to UNC4899, a DPRK-nexus actor, with a history of targeting companies within the cryptocurrency vertical." "JumpCloud reported this unauthorized access impacted fewer than five customers and less than 10 devices."
JumpCloud intrusion · July 2023
Footnote 114: “In July 2023, JumpCloud, an information technology management company, announced that a Democratic People’s Republic of Korea cyberthreat actor had gained unauthorized access to its system to target a small and specific set of its customers ... Cybersecurity companies identified the Lazarus Group as the culprit behind this supply chain attack and cryptocurrency theft as the objective”
JumpCloud compromise · July 2023
Para 136: “In July, the software-as-a-service provider JumpCloud was compromised by Democratic People’s Republic of Korea actors associated with cryptocurrency heists, likely through a sophisticated spearphishing campaign (see figure XXIII); according to a blockchain company, this compromise may have resulted in at least two cryptocurrency heists by the Democratic People’s Republic of Korea, with a combined value of $147.5 million (see annex 95).” Footnote 94: “UNC4899, which reportedly overlaps with the Lazarus Group and Kimsuky.”
JumpCloud supply chain compromise affecting a US-based software solutions entity · 2023-07-24 (datePublished)
In July 2023, Mandiant Consulting responded to a supply chain compromise affecting a US-based software solutions entity. We believe the compromise ultimately began as a result of a sophisticated spear phishing campaign aimed at JumpCloud, a zero-trust directory platform service used for identity and access management. JumpCloud reported this unauthorized access impacted fewer than five customers and less than 10 devices. ... Mandiant attributed these intrusions to UNC4899, a Democratic People's Republic of Korea (DPRK)-nexus actor, with a history of targeting companies within the cryptocurrency vertical.
JumpCloud Intrusion | Attacker Infrastructure Links Compromise to North Korean APT Activity | SentinelOne · 2023-07-20T10:00:14.000Z
North Korean state sponsored APT is behind a new supply chain attack on zero-trust directory platform JumpCloud.