Novo Nordisk Breach Linked to Stolen GitHub Tokens, FulcrumSec's 'Hardcoded Horrorshow' Campaign
Cyber extortion group FulcrumSec exploited stolen GitHub access tokens found in client-side JavaScript to exfiltrate over a terabyte of data from pharmaceutical giant Novo Nordisk.
Pharmaceutical giant Novo Nordisk has fallen victim to a significant data breach, with the cyber extortion group FulcrumSec claiming responsibility. The breach, which resulted in the exfiltration of over a terabyte of sensitive data, was facilitated by the discovery and exploitation of stolen GitHub access tokens. FulcrumSec, known for its "Hardcoded Horrorshow" campaign, targets organizations by exploiting improperly secured credentials, particularly those hardcoded into public-facing infrastructure.
The attackers detailed their initial access vector, stating they found two hardcoded credentials within client-side JavaScript on unrelated Novo Nordisk subdomains. One credential was a personal access token for Azure DevOps, while the other was a GitHub Personal Access Token (PAT). This GitHub PAT proved particularly valuable, granting FulcrumSec access to over a thousand private repositories.
These repositories were reportedly packed with further secrets, including API tokens, database credentials, and service account passwords. This allowed the threat actors to move laterally throughout Novo Nordisk's cloud environments, which included instances on Amazon Web Services and Hugging Face. For approximately two months, FulcrumSec utilized this access to exfiltrate data.
FulcrumSec's modus operandi involves industrializing the process of finding exposed credentials and following the access wherever it leads. A report from British threat intelligence firm Lab539 suggests the group operates a custom scanning infrastructure designed to locate exposed credentials. This infrastructure may also exploit newly discovered vulnerabilities, such as the React2Shell flaw.
Once credentials are harvested, they are automatically tested for validity and the level of access they provide. The group then decides whether to proceed with an attack. FulcrumSec claims to use scripts for every stage of their operations, orchestrated to work at scale. They indicated that hardcoded credentials in client-side JavaScript are a reliable entry point, but they are also seeing success in recovering credentials from data leaked in AI training datasets.
This incident underscores the critical importance of secure credential management. The discovery of hardcoded tokens in client-side JavaScript highlights a fundamental security lapse that allowed attackers to gain extensive access. Novo Nordisk, a company with significant cybersecurity resources, was apparently susceptible to this elementary mistake, which FulcrumSec noted was made twice by different teams.
The exfiltrated data from Novo Nordisk is reported to include sensitive information related to AI and machine learning ecosystems. FulcrumSec's decision to release the data after Novo Nordisk refused to pay ransom demonstrates the high stakes involved in these types of extortion attacks. The group's detailed explanations of their methods serve as a stark warning to other organizations about the pervasive risks of exposed secrets.
For defenders, the key takeaways are clear: rigorously eliminate hardcoded credentials from code and build artifacts, patch applications promptly, and enforce the principle of least privilege. Furthermore, organizations must improve their ability to detect such intrusions in progress, as the attackers were able to operate within Novo Nordisk's cloud services for weeks or months before detection.