Ransomware actors weaponize JetBrains TeamCity RCE flaw
Ransomware gangs have been observed targeting a recently patched remote code execution vulnerability in JetBrains' TeamCity software
TeamCity is a build management and continuous integration server that provides out-of-the-box continuous unit testing, code quality analysis, and early reporting on build problems. Many popular games, websites, and banking systems are built with TeamCity.
Tracked as CVE-2023-42793, the bug is an authentication bypass issue that can lead to remote code execution. According to the vendor, the vulnerability impacts all TeamCity versions before the patched release but only On-Premises servers installed on Windows, Linux, and macOS, or that run in Docker.
Researchers at threat intelligence company Prodaft said they saw multiple organizations being targeted by “many popular” ransomware groups using the said bug.
Threat intelligence company GreyNoise has been observing exploitation attempts since September 27, with attacks coming from 74 unique IP addresses.
According to data from the non-profit internet security organization Shadowserver Foundation, currently, there are roughly 1250 unpatched TeamCity servers exposed on the internet.
Latest Posts
What is Vulnerability Management? A Beginner's Guide
In this article will try to cover basics of vulnerability management process and why it is important to every company.
Cyber Security Week in Review: September 6, 2024
In brief: the US charges Russian GRU hackers for attacks on Ukraine, Apache, Cisco, Zyxel patch high-risk flaws, Google fixes Android zero-day, and more.
Threat actors using MacroPack Red Team framework to deploy Brute Ratel, Havoc and PhantomCore
Some of the documents appeared to be part of legitimate Red Team exercises, while other were intended for malicious purposes.