Cloudflare Discloses Hackers Accessed Code, Documents in 2023 Okta Breach
Cloudflare has disclosed that it experienced a likely nation-state attack, where the threat actor utilized stolen credentials to gain unauthorized entry into its Atlassian server, obtaining access to some documentation and a limited amount of source code.
The breach occurred from November 14 to 24, 2023, with detection on November 23. Cloudflare characterized the actor as "sophisticated," operating with a deliberate and methodical approach to achieve persistent and widespread access to the company's global network.
As a precautionary measure, Cloudflare rotated over 5,000 production credentials, physically segmented test and staging systems, conducted forensic triages on 4,893 systems, and reimaged and rebooted every machine across its global network.
During the incident, a four-day reconnaissance period allowed the threat actor to access Atlassian Confluence and Jira portals. Subsequently, a rogue Atlassian user account was created, establishing persistent access to the Atlassian server and ultimately gaining entry to the Bitbucket source code management system using the Sliver adversary simulation framework.
Code Repositories Accessed by Attackers
Approximately 120 code repositories were accessed, with an estimated 76 believed to have been exfiltrated by the attacker. These repositories primarily pertained to backup processes, global network configuration and management, identity practices at Cloudflare, remote access, and the company's utilization of Terraform and Kubernetes.
Cloudflare stated that a few repositories contained encrypted secrets, which were promptly rotated despite their strong encryption.
The threat actor unsuccessfully attempted to access a console server linked to a data center in São Paulo, Brazil, not yet in production.
The attack exploited one access token and three service account credentials associated with Amazon Web Services (AWS), Atlassian Bitbucket, Moveworks, and Smartsheet. These credentials were stolen in October 2023 during the hack of Okta's support case management system. Cloudflare acknowledged a failure to rotate these credentials, mistakenly assuming they were unused.
The company terminated all malicious connections from the threat actor on November 24, 2023, and engaged cybersecurity firm CrowdStrike for an independent assessment of the incident.
