North Korean hackers hacked US IT company in bid to steal crypto By Reuters

[ad_1]

2/2 Reuters. Miniatures of people with computers are seen in front of the North Korea flag in this illustration taken July 19, 2023. REUTERS/Dado Ruvic/Illustration 2/2

By Christopher Bing and Raphael Satter

WASHINGTON (Reuters) – A North Korean government-backed hacking group broke into a U.S. IT management company and used it as a springboard to target cryptocurrency companies, the company and cybersecurity experts said on Thursday.

Hackers broke into Louisville, Colorado-based JumpCloud in late June and used their access to the company’s systems to target “less than 5” of its customers, it said in a blog post.

JumpCloud did not identify the affected customers, but cybersecurity firms CrowdStrike Holdings (NASDAQ:) — which assists JumpCloud — and Alphabet-owned Mandiant — which assists one of JumpCloud’s customers — both said the hackers involved were known to focus on stealing cryptocurrency.

Two people familiar with the matter confirmed that the JumpCloud customers targeted by the hackers were cryptocurrency companies.

The hack shows how North Korean cyber spies, once content to go after digital currency companies on a piecemeal basis, are now going after companies that can give them wider access to multiple downstream victims – a tactic known as the “supply chain attack”.

In my opinion, North Korea is really stepping up their game, said Tom Hegel, who works for US company SentinelOne (NYSE:) and independently confirmed the Mandiant and CrowdStrike attribution.

Pyongyang’s mission to the United Nations in New York did not respond to a request for comment. North Korea has previously denied organizing digital currency thefts, despite ample evidence – including UN reports – to the contrary.

CrowdStrike identified the hackers as “Labyrinth Chollima” – one of several groups alleged to operate on behalf of North Korea. Mandiant said the hackers responsible worked for North Korea’s Reconnaissance General Bureau (RGB), its main foreign intelligence agency.

US cyber surveillance agency CISA and the FBI declined to comment.

The hack of JumpCloud, whose products are used to help network administrators manage devices and servers, first surfaced earlier this month when the company emailed customers to tell them that their information identification would be changed out of caution regarding an ongoing incident.

In an earlier version of the blog post that acknowledged the incident was a hack, JumpCloud traced the intrusion back to June 27. The cybersecurity-focused Risky Business podcast earlier this week cited two sources as saying North Korea was a suspect in the intrusion.

Labyrinth Chollima is one of North Korea’s most prolific hacking groups and is believed to be responsible for some of the most daring and disruptive cyber intrusions in the isolated country. His theft of cryptocurrency resulted in the loss of exorbitant sums: blockchain analysis firm Chainalysis said last year that groups linked to North Korea had stolen around $1.7 billion in digital money on several hacks.

CrowdStrike’s senior vice president for intelligence, Adam Meyers, said Pyongyang’s hacking teams should not be underestimated.

“I don’t think this will be the last time we will see attacks on the North Korean supply chain this year,” he said.

[ad_2]