A little over a week after JumpCloud reset API keys of customers impacted by a security incident, the company said the intrusion was the work of a sophisticated nation-state actor.
The adversary “gained unauthorized access to our systems to target a small and specific set of our customers,” Bob Phan, chief information security officer (CISO) at JumpCloud, said in a post-mortem report. “The attack vector used by the threat actor has been mitigated.”
Further analysis of the breach, per the company’s disclosure, unearthed the attack vector, which it described as a “data injection into the commands framework.” It also said the attacks were highly targeted.
JumpCloud, however, did not explain how the phishing attack it spotted in June is connected to the data injection. It’s currently not clear if the phishing emails led to the deployment of malware that facilitated the attack.
Additional indicators of compromise (IoCs) associated with the attack shows that the adversary leveraged domains named nomadpkg[.]com and nomadpkgs[.]com, a likely reference to the Go-based workload orchestrator used to deploy and manage containers.
“These are sophisticated and persistent adversaries with advanced capabilities,” Phan said. JumpCloud has yet to reveal the name and the origins of the group allegedly responsible for the incident.
Source: https://thehackernews.com/
