JumpCloud blames North Korean hackers for breach

[ad_1]

Cryptocurrency fraud, Cyber ​​warfare/Nation-state attacks, Fraud management and cybercrime

Threat actor is financially motivated to focus on cryptocurrency, says Mandiant Mihir Bagwe (MihirBagwe) • July 20, 2023 This undated photo shows students at Mangyongdae Revolutionary School in Pyongyang working on computers. (Image: Korea Central News Agency)

Days after attributing the recent breach in its customer environment, enterprise software firm JumpCloud on Thursday confirmed the involvement of a North Korean nation-state actor who appears to be financially motivated to steal cryptocurrency.

See also: On demand | Overcoming the Limits of Countering Insider Threats in Banking: Real Solutions for Real Security Challenges

Bob Phan, information security manager at JumpCloud, confirmed that “less than five JumpCloud customers and less than 10 devices in total were affected.”

Bob said the company serves more than 200,000 organizations that rely on the JumpCloud platform for a variety of identity, access, security, and management functions, and it’s important to disclose that the attack was highly targeted and limited to specific customers.

“All affected customers have been notified directly,” Bob said. The investigation is ongoing, and US federal law enforcement and private cybersecurity firm CrowdStrike are assisting with forensic and incident response activities, he added.

Financially Motivated Actor

While JumpCloud did not name the threat actor behind the surgical attack and Crowdstrike declined to comment citing “active engagement”, Reuters quoting Adam Meyers, senior vice president of intelligence at Crowdstrike, identified the hackers as “Labyrinth Chollima” – one of the most prolific adversaries of the Democratic People’s Republic of Korea tracked by CrowdStrike and has been active at least since 2009.

Another cybersecurity firm, Mandiant, which is currently working with one of the downstream victims compromised by the JumpCloud intrusion, also attributed the attack to North Korean hackers.

Austin Larsen, Senior Incident Response Consultant for Mandiant, told Information Security Media Group, “Mandiant assesses with great confidence that this is a cryptocurrency-focused element within the DPRK Reconnaissance General Office. [RGB]targeting businesses with cryptocurrency verticals for credentials and reconnaissance data.”

He further stated that it is a financially motivated threat actor that Mandiant has seen increasingly target the cryptocurrency industry and various blockchain platforms. “The mixing and sharing of DPRK cyberinfrastructure makes attribution often difficult, but targeting remains consistent,” Larsen said.

According to Mitre, Labyrinth Chollima is closely associated with the famous North Korean group Lazarus and their tactics and techniques often overlap. SentinelOne Senior Threat Researcher Tom Hegel, who studied indicators of compromise recently shared by JumpCloud, tweeted that he was “very confident in the attribution of JumpCloud intrusion IOCs to North Korean threat actors” and suspects that Lazarus may be involved, although more details are needed to determine accuracy.

Hegel in a blog post explained how he linked the indicators of compromise to the APT infrastructure attributed to the DPRK.

“It is evident that North Korean threat actors are constantly adapting and exploring new methods to infiltrate targeted networks,” Hegel said. “JumpCloud’s intrusion clearly illustrates their penchant for targeting the supply chain, which generates a host of potential subsequent intrusions. The DPRK demonstrates a deep understanding of the benefits derived from the careful selection of high-value targets as a pivot point for conducting attacks from the supply chain to successful networks.

[ad_2]