A little over a week after JumpCloud reset API keys of customers impacted by a security incident, the company said the intrusion was the work of a sophisticated nation-state actor.
The adversary "gained unauthorized access to our systems to target a small and specific set of our customers," Bob Phan, chief information security officer (CISO) at JumpCloud, said in a post-mortem report. "The attack vector used by the threat actor has been mitigated."
The U.S. enterprise software firm said it identified anomalous activity on June 27, 2023, on an internal orchestration system, which it traced back to a spear-phishing campaign mounted by the attacker on June 22.
While JumpCloud said it took security steps to shield its network by rotating credentials and rebuilding its systems, it wasn't until July 5 when it detected "unusual activity" in the commands framework for a small set of customers, prompting a forced-rotation of all admin API keys. The number of affected customers was not disclosed.
Further analysis of the breach, per the company's disclosure, unearthed the attack vector, which it described as a "data injection into the commands framework." It also said the attacks were highly targeted.
JumpCloud, however, did not explain how the phishing attack it spotted in June is connected to the data injection. It's currently not clear if the phishing emails led to the deployment of malware that facilitated the attack.
Additional indicators of compromise (IoCs) associated with the attack shows that the adversary leveraged domains named nomadpkg[.]com and nomadpkgs[.]com, a likely reference to the Go-based workload orchestrator used to deploy and manage containers.
"These are sophisticated and persistent adversaries with advanced capabilities," Phan said. JumpCloud has yet to reveal the name and the origins of the group allegedly responsible for the incident.
