Cyber security firm Rapid7 has revealed that a cyber attack against its supplier CodeCov led to hackers accessing a subset of its source code repositories.
The code coverage platform CodeCov suffered an incident last month in which attackers broke through its defences and modified its Bash Uploader script, meaning hundreds of clients who executed the script may have also been compromised.
Rapid7, which uses the service, confirmed it was among the string of companies whose networks were infiltrated due to the attack. The cyber criminals accessed source code used for the firm’s internal tooling as well as its managed detection and response (MDR) service.
MDR is a set of capabilities that Rapid7 markets as being able to detect advanced threats and stop attackers while infiltration attempts are in process. Part of the package includes threat hunting, 24/7 monitoring, as well as rapid incident response.
The source code repositories accessed also contained internal company credentials, which have all been rotated, and alert-related data for a portion of MDR customers. Rapid7 has said it has contacted any customers that may be affected.
Codecov develops auditing tools that clients can use to see how thoroughly their own code is being tested, which may give this tool access to credentials for internal software accounts.
Following the breach, the FBI feared that the attackers used an automated system to copy those credentials and raid additional resources, according to Reuters.
IBM was also among the companies to have revealed they were using Codecov, although a spokesperson told the publication at the time that they had found no modifications of code involving IBM or its clients.
The hack, described as a supply chain attack, is eerily similar in nature to both the SolarWinds Orion attack in late 2020 and the Microsoft Exchange Server breach earlier this year. These are considered among the worst security incidents in recent months, and both saw potentially thousands of businesses compromised after the systems of their supplier, in each case, was breached.
