A sophisticated threat organization tied to the North Korean state has reportedly compromised systems within the cloud-based IT management provider JumpCloud. Threat actors were able to gain access to the company’s infrastructure through a meticulously crafted spear phishing campaign against company employees. Based on indicators of compromise provided to security researchers, several indicators were noted as malicious including a major web hosting server IP address known for its usage by multiple threat groups. While the malicious hosting IP address is benign by itself, security researchers noted one (1) domain on this hosting address that matched a suspicious domain captured on JumpCloud networks. The suspected domain also shared an SSL (Secure Sockets Layer) certificate with another suspicious domain which could potentially disclose some information about the threat actor(s). Paired with other indicators and malicious artifacts, security analysts have medium-high confidence that the attack originated from Lazarus Group, a well-established North Korean hacking team responsible for numerous cyberattacks. Lazarus hackers appear to have targeted JumpCloud systems for financial benefit, potentially hoping to gather intelligence on the company’s cryptocurrency clientele to steal their digital assets. CTIX continues to monitor fallout from the JumpCloud compromise and will provide additional updates accordingly.