Cybersafetyconnections July 31st, 2023, vol#128 

  • Spear-phishing attack on cloud provider JumpCloud based out of Louisville, Colorado, USA (Boulder County). 
  • This incident is important because JumpCloud is an identity and access management provider. 
  • North Korea has been identified and confirmed as the nation state actor through partnering with CrowdStrike. 
  • Only a small segment, less than 5% of JumpCloud customers, was impacted. 
  • JumpCloud mitigated loss through collaboration and information sharing. 

What happened? 

Spear-Phishing 

JumpCloud recently experienced a spear-phishing attack from a nation-state sponsored threat actor through gaining unauthorized access to a specific part of its system.

Why is this important? 

Identity and Access Management 

JumpCloud is an identity and access management provider providing multidirectory management, identity and access management, multifactor authentication, single sign-on and integration with various third-party services. 

JumpCloud based out of Louiseville,Colorado says its cloud directory platform is used by more than 180,000 organizations across at least 160 countries. 

Imagine hijacking the system, identifying and giving access to cybercriminals. This is like going to the source and trying to steal people’s login credentials to gain access and possibly take over their online accounts, platform and resources. 

Who is responsible? 

North Korea Nation State 

The nation state threat actors as identified by JumpCloud and confirmed by CrowdStrike is North Korea.  

Who was impacted? 

JumpCloud Customers 

A small percentage of JumpCloud customers, less than 5% suffered the cyberattack and less than 10 devices were affected from over 200,000 organizations that use JumpCloud platform to meet their objectives. The affected customers were notified directly. 

What steps were taken to mitigate loss? 

Pre and Post Disaster Management Plan 

  • JumpCloud took immediate action to address the incident, secure its network and perimeter, communicate with its customers, and engage law enforcement. 
  • The identity and access management provider gave assurance that it got rid of the threat and reduced its impact on the small percentage of affected customers. 
  • JumpCloud partnered with CrowdStrike as incident response team, identified North Korea as the nation state actor which was also confirmed by CrowdStrike. JumpCloud is currently working with US federal law enforcement as well in the ongoing investigation, and also staying in contact with affected customers.  
  • Because the threats actors are sophisticated and persistent with advance capabilities, JumpCloud is beefing up its strongest cybersecurity defenses of information sharing and collaboration. That is with CrowdStrike response team so they can secure their environment against this threat. 
  • The company’s team remains vigilant in monitoring new and emerging threats, are committed to enhancing security measures to protect its customers and continue to work with the government and industry partners to share information regarding this threat. 

Subscribe to get the latest post.