Brevo Supply-Chain Attack Leveraged Stolen Cloudflare Key for Malware Distribution

Brevo Platform Compromised in Supply-Chain Attack

Email marketing and CRM provider Brevo has confirmed a significant security incident where attackers gained unauthorized access to its systems, leading to the injection of malicious scripts onto customer websites. The attackers exploited a compromised Cloudflare API key to insert malicious ClickFix scripts. These scripts were designed to distribute malware by redirecting unsuspecting users to malicious sites or prompting unwanted downloads.

The incident, which Brevo disclosed on November 28, 2023, highlights the persistent threat of supply-chain attacks. By compromising a trusted vendor like Brevo, attackers can cast a wide net, affecting numerous downstream businesses that rely on its services for communication and customer management. The use of a stolen Cloudflare API key suggests a sophisticated intrusion, as API keys are critical access credentials that, when compromised, can grant attackers extensive control over network infrastructure and content delivery.

Brevo stated that the attackers gained access to the API key, which was subsequently used to inject malicious JavaScript code into the websites and JavaScript files hosted by Brevo for its clients. This code, identified as ClickFix scripts, is a known type of malicious payload often used in web-based attacks to redirect users or deliver further malware. The company has since revoked the compromised API key and is working to identify and remove all instances of the malicious code.

Attack Vector and Malicious Payload

The primary vector for this attack was the compromise of a Cloudflare API key belonging to Brevo. Cloudflare is a widely used content delivery network and security provider, and its services are integral to the operation of many websites, including managing DNS, providing DDoS protection, and serving web content. A compromised API key for such a service is akin to handing over the keys to the castle.

Once the attackers obtained the API key, they were able to manipulate the content being served through Brevo's infrastructure. This allowed them to inject the ClickFix scripts. These scripts are a form of malicious JavaScript that can perform various harmful actions. In this instance, the scripts appear to have been used to redirect users to malicious websites, potentially for phishing, credential harvesting, or to trigger drive-by downloads of malware. The exact nature of the malware distributed has not been fully detailed by Brevo, but the implication is that user systems were at risk.

The insidious nature of this attack lies in its use of Brevo's legitimate infrastructure. For customers using Brevo's services, the injected scripts appeared to be part of their own website's code, making detection more difficult. This trust relationship is precisely what supply-chain attacks aim to exploit. By leveraging Brevo's established platform, the attackers could bypass many standard security measures that might otherwise block direct malicious content delivery.

Brevo's Response and Mitigation Efforts

Upon discovering the breach, Brevo initiated an incident response protocol. The company's security team immediately moved to revoke the compromised Cloudflare API key, thereby cutting off the attackers' ability to inject further malicious code. This was a critical first step in containment.

Brevo then launched an investigation to determine the full scope of the compromise. This involved identifying which customer websites or JavaScript files had been affected by the malicious injections. The company has been actively working to remove the ClickFix scripts from all compromised locations. For customers whose sites were affected, Brevo has provided guidance and support to ensure their web assets are clean and secure.

The company also emphasized that its investigation is ongoing and that it is cooperating with relevant authorities. Brevo has committed to enhancing its security measures to prevent similar incidents in the future. This includes a review of its API key management practices and a broader assessment of its cloud infrastructure security protocols. The goal is to ensure that customer data and integrity remain protected, even in the face of sophisticated external threats.

Broader Implications for Supply-Chain Security

This incident serves as a stark reminder of the vulnerabilities inherent in digital supply chains. Businesses today rely on a complex web of third-party services, software, and cloud infrastructure. A compromise at any point in this chain can have cascading effects. For Brevo's customers, their websites became unwitting conduits for malware distribution, directly impacting their own users and brand reputation.

The reliance on Cloudflare, a critical piece of internet infrastructure, by Brevo underscores the interconnectedness of the digital ecosystem. When a service like Cloudflare is compromised through a trusted partner, the blast radius can be enormous. This incident highlights the need for robust security practices not just for direct users of a service, but for the providers themselves to diligently protect their own infrastructure and credentials.

What remains to be fully understood is the extent of the data accessed or exfiltrated by the attackers beyond the injection of malicious scripts. While Brevo has focused on the script injection, the initial compromise that led to the theft of the Cloudflare API key could potentially have exposed other sensitive information or provided a deeper foothold within Brevo's systems. The long-term impact on customer trust and the potential for future, more targeted attacks based on any information gained during this breach are significant considerations.