We review vendors based on rigorous testing and research but also take into account your feedback and our affiliate commission with providers. Some providers are owned by our parent company.
Learn more
vpnMentor was established in 2014 as an independent site reviewing VPN services and covering privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize the independent, professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.
Advertising Disclosure

vpnMentor was established in 2014 as an independent site reviewing VPN services and covering privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize the independent, professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.

North Korean Hackers Target JumpCloud Systems

North Korean Hackers Target JumpCloud Systems
Keira Waddell Published on 23rd July 2023 Senior Writer

JumpCloud, a US-based identity and access management firm, recently made a disclosure regarding unauthorized access to its systems by a North Korean nation-state actor. The breach occurred a month ago and involved a spear-phishing attack against a targeted group of customers.

The incident was brought to light when JumpCloud discovered unusual activity within an internal orchestration system on June 27th. Upon thorough investigation, the company traced the breach back to a spear-phishing campaign that the attacker launched on June 22nd. In response, JumpCloud promptly took action to protect its network by rotating credentials and rebuilding its systems.

Initially, JumpCloud believed that there was no direct impact on its customers. However, on July 5th, the company detected anomalous activity related to a specific group of customers in its commands framework. As a proactive measure to safeguard its customers, JumpCloud chose to reset customers’ API keys and helped affected customers take additional security measures.

Further analysis revealed the targeted nature of the attack, confirming that the breach was limited to a carefully chosen set of customers. On July 20th, JumpCloud disclosed that the nation-state threat actor involved was from North Korea, and that “fewer than 5 JumpCloud customers were impacted and fewer than 10 devices total were impacted”.

In response to the intrusion, JumpCloud took comprehensive measures, including notifying law enforcement and publishing indicators of compromise (IOCs) to assist other organizations in identifying similar attacks.

JumpCloud is a provider of authentication and user/device management services, serving over 180,000 organizations in more than 160 countries, with more than 5,000 paying customers, including well-known names like Beyond Finance, Cars.com, ClassPass, Foursquare, GoFundMe, and Grab.

The Chief Information Security Officer of JumpCloud, Bob Phan, reassured customers that the attack vector used by the hackers had been mitigated. The company also pledged to continuously strengthen its security measures and collaborate closely with government and industry partners to counter future threats.

About the Author

Keira is an experienced cybersecurity and tech writer dedicated to providing comprehensive insights on VPNs, online privacy, and internet censorship.