Novo Nordisk Data Breach Tied to Stolen GitHub Access Tokens

Hardcoded credentials recovered from corporate cloud environments are giving hackers ongoing, easy access to experimental drug data, customer records and more.

See Also: Why Enterprises Are Flying Blind in the Age of AI Security

Cyber extortionist group FulcrumSec, which specializes in ransoming sensitive data, continues to employ this strategy, going so far as to dub it the "Hardcoded Horrorshow." The group's victims have included England's Manchester Airport Groups , London-based consultancy Arup Group and Singapore-based Global Schools Group, among others.

The group began shaking down Ozempic maker Novo Nordisk in June, subsequently releasing more than 1 terabyte of stolen data after the Danish drug giant refused to pay (see: Extortion Gang Leaks Novo Nordisk's 'AI and ML Ecosystem' ).

"We gained initial access through secrets left in client-side JavaScript on two separate unrelated Novo Nordisk subdomains - two completely different teams, two different applications, the same elementary mistake made twice," FulcrumSec, said in a post to its data leak site. The group's blog includes an unusual amount of detail pertaining to how it breached any given organization, and illustrates the breadth of exposed credentials the criminals have successfully exploited.

In the case of Novo Nordisk, the gang claimed that it found two hardcoded credentials: a JavaScript bundle on one public-facing site containing a personal access token for the Azure DevOps environment, and client-side code on another site containing a GitHub PAT that granted access to numerous other code repositories "packed with more secrets - API tokens, database credentials, service account passwords - that enabled lateral movement through Novo's systems."

The attackers said that for two months, they used that access to spider through the Danish drug giant's cloud environments, including Amazon Web Services and Hugging Face instances to exfiltrate data.

"The GitHub PAT alone gave us access to over a thousand private repositories, many containing hardcoded credentials for production systems, allowing us to spider our way throughout Novo's various cloud systems," they said.

Opportunistic Victim Identification

For FulcrumSec, seemingly any type of exposed credential is an opportunity. "They have industrialized finding those mistakes and then following the access wherever it leads," says a Wednesday report from British threat intelligence firm Lab539.

Seeking more details how the group operates, Lab539 security researcher John Fitzpatrick asked, and the group responded. He couldn't validate everything the group claimed, but it appears FulcrumSec runs a bespoke, multi-server scanning infrastructure designed to find exposed credentials, including by exploiting new flaws that come to light, such as last year's React2Shell in React hosts (see: Nation-State and Cybercrime Exploits Tied to React2Shell ).

Harvested credentials get automatically tested to see if they work, and what levels of authentication and access they might provide, then the group decides whether or not to proceed. "They tell me that they have scripts for every stage of their attacks, all held together by orchestration scripts, which makes sense at the scale they appear to be operating. Just plugging a token or credentials into the pipeline gives them a huge amount of intel what access it might provide," Fitzpatrick said.

The gang told Fitzpatrick that its most reliable entry vector is hardcoded credentials recovered from client-side JavaScript. "But we have something else running that has to do with artificial intelligence training datasets," it told the researcher, which "is currently outpacing" client-side JavaScript.

Fitzpatrick told ISMG that he took this to mean the group is recovering many more credentials now from "data leaked in AI training data sets," rather than the group itself using AI.

Using dedicated scripts means there's no need for LLMs, which might just slow the attackers down. "Ironically we do something similar to them, hunting adversarial infrastructure, and we stay well clear of LLMs - they just wouldn't perform or be efficient or accurate at the rate at which they claim to be operating," he said.

Don't Leave Secrets in Public Repositories

For defenders, the need to find and eliminate hardcoded credentials left exposed in publicly exposed sites, as well as accounts with excess permissions, is an obvious takeaway from FulcrumSec's success.

The group itself also lauded a June report from cybersecurity firm Sysdig, which detailed specific steps to take, including the need to "Eliminate secrets from code and build artifacts," patch applications faster and enforce least-privileged access.

Clearly, detecting these types of attacks when their in-progress is another must-have.

FulcrumSec said of Novo Nordisk: "It remains astonishing to us, even now that we have seen this pattern again and again, that a $400 billion corporation with a dedicated cybersecurity division cannot be bothered to monitor their frontend bundles. That they could not detect unknown IPs raiding their cloud services for weeks and months before responding (or never detecting us at all, in the case of their Hugging Face and Okta accounts)."

But spotting this type of illicit activity can be easier said than done. "A lot of FulcrumSec's activity is technically legitimate: valid tokens, API keys and cloud identities being used for the things they were designed to do. There is often no malware, payload or endpoint activity to detect," Fitzpatrick said.

For defenders, one strategy is to baseline what normal activity looks like. "A PAT cloning repositories is normal; cloning thousands from unfamiliar infrastructure probably isn't. An application reading a secret is normal; enumerating dozens of unrelated secrets probably isn't. Scripts are noisy when operating at scale and defenses need to be better at identifying and operating on that noise," Fitzpatrick said.

The challenge is that what looks normal typically varies by every different organization, meaning security teams need to tailor detection to their own particular environment and services.

"Generic tooling can provide the telemetry and does provide the functionality to implement exactly these types of detection. But it requires someone has to tell it what 'normal' - or 'abnormal' - looks like, it needs some tailoring to the business operations, otherwise nothing will be detected," he said.

Fraud Management & Cybercrime

Governance & Risk Management

Executive Editor, DataBreachToday & Europe, ISMG

Schwartz is an award-winning journalist with two decades of experience in magazines, newspapers and electronic media. He has covered the information security and privacy sector throughout his career. Before joining Information Security Media Group in 2014, where he now serves as the executive editor, DataBreachToday and for European news coverage, Schwartz was the information security beat reporter for InformationWeek and a frequent contributor to DarkReading, among other publications. He lives in Scotland.