binarypublish
Russian state-sponsored hackers, linked to APT 29 group, have been exploiting vulnerability CVE-2023-42793 targeting unpatched, internet-facing JetBrains TeamCity servers since September 2023, as revealed by US, UK and Polish cybersecurity and law enforcement authorities. The targets span across a variety of organizations including government sectors, IT companies, energy corporations and more, with disparate units across the US, Europe, Asia and Australia being affected.
- APT 29, linked with the Russian Foreign Intelligence Service, has remained active since 2013, with a history of targeting prominent organizations to collect foreign intelligence.
- The latest attacks exploit an authentication bypass vulnerability in the TeamCity CI/CD platform. Almost 800 JetBrains TeamCity unpatched instances are still observed around the world according to Shadowserver Foundation.
- The hack progression entails an initial access by exploiting the vulnerability, followed by networking and host reconnaissance, privilege escalation, lateral moves, deployment of backdoors and measures to ensure long-term access to compromised networks.
- JetBrains has responded to the situation by releasing a security patch. They stated that fewer than 2% of TeamCity instances are still running unpatched software.
The compromised servers primarily belong to an extensive range of businesses, such as IT companies, energy corporations, and government agencies, in various strategic sectors. Once the hackers gain access to these servers, they can monitor and manipulate the software development activity, thus posing a severe threat to data security and privacy.
The agencies have released an advisory detailing the indicators of compromise and the techniques employed by the attackers. Security teams should browse these advisories for signs of intrusion, especially if their TeamCity servers remain unpatched.
The exploitation of CVE-2023-42793 does not end with APT 29. Reports suggest that Korea-backed hacking groups Lazarus and Andariel have also leveraged the same vulnerability since early October 2023 to maintain steady access to compromised networks for future operations.
JetBrains has been proactive in addressing this vulnerability by releasing a dedicated security patch in September 2023. Companies using older versions of the software can use this patch to upgrade. JetBrains Head of Security, Yaroslav Russkih, has urged all organizations to update their software and follow the best security practices as shared by them.
