DNS Insights behind the JumpCloud Supply Chain Attack | WhoisXML API

Threat Reports

DNS Insights behind the JumpCloud Supply Chain Attack

Cybersecurity has become a must to every organization given the proliferation of attacks. It’s quite ironic then when even the solutions we use to protect our systems and identities get exploited.

Researchers recently uncovered supply chain attacks targeting identity access management (IAM) platform JumpCloud.1 A total of 32 IoCs related to the threat have been identified.

To make the Internet safer and more transparent, WhoisXML API took a closer look at the JumpCloud supply chain attack IoCs via a DNS deep dive and identified more artifacts, namely:

  • 145 domains that shared some of the dedicated IP hosts identified as IoCs, one of which has been dubbed malicious based on a bulk malware check
  • 392 domains that contained the strings centos, datadog, and zscaler akin to some of the domains identified as IoCs

Download a sample of the threat research materials now or contact us to access the complete set of research materials.

  • [1] https://securityaffairs.com/148680/apt/north-korea-jumpcloud-attack.html
  • [2] https://jumpcloud.com/support/july-2023-iocs
Try our WhoisXML API for free
Get started