North Korea hackers breached US IT company in bid to steal crypto By Reuters

2/2

© Reuters. Miniatures of individuals with computer systems are seen in entrance of North Korea flag on this illustration taken July 19, 2023. REUTERS/Dado Ruvic/Illustration

2/2

By Christopher Bing and Raphael Satter

WASHINGTON (Reuters) -A North Korean government-backed hacking group penetrated an American IT administration firm and used it as a springboard to focus on cryptocurrency firms, the agency and cybersecurity specialists mentioned on Thursday.

The hackers broke into Louisville, Colorado-based JumpCloud in late June and used their entry to the corporate’s programs to focus on “fewer than 5” of its purchasers, it mentioned in a weblog submit.

JumpCloud didn’t establish the purchasers affected, however cybersecurity corporations CrowdStrike Holdings (NASDAQ:) – which is helping JumpCloud – and Alphabet-owned Mandiant – which is helping considered one of JumpCloud’s purchasers – each mentioned the hackers concerned have been identified to concentrate on cryptocurrency theft.

Two individuals acquainted with the matter confirmed that the JumpCloud purchasers focused by the hackers have been cryptocurrency firms.

The hack reveals how North Korean cyber spies, as soon as content material with going after digital forex corporations piecemeal, are actually tackling firms that may give them broader entry to a number of victims downstream – a tactic referred to as a “provide chain assault.”

“North Korea for my part is basically stepping up their sport,” mentioned Tom Hegel, who works for U.S. agency SentinelOne (NYSE:) and independently confirmed Mandiant and CrowdStrike’s attribution.

Pyongyang’s mission to the United Nations in New York didn’t reply to a request for remark. North Korea has beforehand denied organizing digital forex heists, regardless of voluminous proof – together with U.N. experiences – on the contrary.

CrowdStrike recognized the hackers as “Labyrinth Chollima” – considered one of a number of teams alleged to function on North Korea’s behalf. Mandiant mentioned the hackers accountable labored for North Korea’s Reconnaissance Basic Bureau (RGB), its major overseas intelligence company.

The U.S. cyber watchdog company CISA and the FBI declined to remark.

The hack on JumpCloud – whose merchandise are used to assist community directors handle units and servers – first surfaced publicly earlier this month when the agency emailed clients to say their credentials can be modified “out of an abundance of warning referring to an ongoing incident.”

In an earlier model of the weblog submit that acknowledged that the incident was a hack, JumpCloud traced the intrusion again to June 27. The cybersecurity-focused podcast Dangerous Enterprise earlier this week cited two sources as saying that North Korea was a suspect within the intrusion.

Labyrinth Chollima is considered one of North Korea’s most prolific hacking teams and is alleged to be liable for a few of the remoted nation’s most daring and disruptive cyber intrusions. Its theft of cryptocurrency has led to the lack of eye-watering sums: Blockchain analytics agency Chainalysis mentioned final 12 months that North Korean-linked teams stole an estimated $1.7 billion value of digital money throughout a number of hacks.

CrowdStrike Senior Vice President for Intelligence Adam Meyers mentioned Pyongyang’s hacking squads shouldn’t be underestimated.

“I do not suppose that is the final we’ll see of North Korean provide chain assaults this 12 months,” he mentioned.