Cloudflare, a prominent Internet security and DDoS protection company, recently fell victim to a cyberattack linked to the widespread Okta supply-chain campaign last fall. The breach, affecting Cloudflare’s Atlassian Bitbucket, Confluence, and Jira platforms, commenced on Thanksgiving Day.
Cloudflare, in collaboration with industry and government partners, determined that a nation-state attacker aimed to gain persistent and widespread access to its global network. Working with CrowdStrike, the company found that cyber attackers initially accessed the internal wiki (Confluence) and bug database (Jira). They later established persistence on the Atlassian server and proceeded to explore potential points of entry. The assailants successfully breached Cloudflare’s source code management system (Bitbucket) and an AWS instance.
The analysis revealed the attackers sought information about the configuration and management of Cloudflare’s global network. They accessed various Jira tickets related to vulnerability management, secret rotation, MFA bypass, network access, and the company’s response to the Okta incident. Fortunately, due to network segmentation and a zero-trust authentication approach limiting lateral movement, the attackers were largely prevented from accessing critical systems.
Despite minimal access, Cloudflare took comprehensive measures, rotating over 5,000 production credentials, segmenting test and staging systems, and conducting forensic triages on nearly 5,000 systems. The company also reimaged and
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.