Just over a week after resetting API keys for customers affected by a security incident, JumpCloud has attributed the breach to the actions of a highly sophisticated nation-state actor.
Bob Phan, Chief Information Security Officer (CISO) at JumpCloud, stated in a post-mortem report that the adversary managed to gain unauthorized access to their systems with a specific focus on a select group of customers. The attack vector employed by the threat actor has since been addressed and mitigated.
The U.S. enterprise software company initially detected unusual activity within an internal orchestration system on June 27, 2023, which was traced back to a spear-phishing campaign initiated by the attacker on June 22.
While JumpCloud took immediate security measures, including credential rotation and system rebuilding, it wasn't until July 5 that they noticed "unusual activity" within the commands framework affecting a small subset of customers. This prompted a mandatory rotation of all admin API keys, although the precise number of impacted customers was not disclosed.
Further analysis of the breach revealed the attack vector, described as a "data injection into the commands framework," which the company noted was highly targeted. However, JumpCloud did not clarify the connection between the phishing attack detected in June and the data injection. It remains unclear whether the phishing emails led to the deployment of malware facilitating the breach.
Additional indicators of compromise (IoCs) linked to the attack include the use of domains named nomadpkg[.]com and nomadpkgs[.]com, likely references to the Go-based workload orchestrator utilized for deploying and managing containers.
Bob Phan emphasized that the adversaries behind this incident are both sophisticated and persistent, possessing advanced capabilities. As of now, JumpCloud has not disclosed the name or the origins of the group believed to be responsible for the security breach.