The Russian cyberespionage group known as APT29 has been exploiting a recent TeamCity vulnerability on a large scale since September 2023, according to government agencies in the US, UK, and Poland.
The issue, tracked as CVE-2023-42793 and impacting on-premises TeamCity instances, is described as an authentication bypass that can be exploited without user interaction to steal sensitive information and take over vulnerable servers.
Exploitation of the bug started days after patches were released in late September, with several ransomware groups observed targeting CVE-2023-42793.
By the end of October, North Korean state-sponsored threat actors were also exploiting the flaw.
Now, government agencies in the US, the UK, and Poland reveal that at least one Russian nation-state actor has been exploiting the vulnerability in cyberattacks since September.
The hacking group, tracked as APT29, CozyBear, the Dukes, Midnight Blizzard, Nobelium, and Yttrium, is believed to be sponsored by the Russian Foreign Intelligence Service, and was previously blamed for the 2016 US election hack, the 2020 SolarWinds attack, and various other high-profile attacks.
As part of the observed attacks, APT29 exploited CVE-2023-42793 to execute code with high privileges and gain a foothold on the target environments.
Next, the attackers performed reconnaissance, exfiltrated files, disabled EDR and anti-virus software, established persistence, and moved to exfiltrate sensitive data.
The cyberespionage group was observed using multiple custom and open source tools and backdoors, such as the GraphicalProton malware, which was initially detailed in July 2023.
TeamCity is used by software developers to manage and automate their processes.
Compromised TeamCity servers could be useful for supply chain attacks, such as the one aimed at SolarWinds.
On the same day that the joint advisory was released, Fortinet published a technical analysis of an APT29 attack, which targeted a US organization in the biomedical manufacturing sector, pointing out that it has observed multiple threat actors attempting to exploit the vulnerable environment.
Organizations are advised to review JetBrains' advisory on CVE-2023-42793, update their TeamCity instances to a patched release, and review the indicators-of-compromise released by the US, UK, and Polish agencies and Fortinet to hunt for malicious activity in their environments.
This Cyber News was published on www.securityweek.com. Publication date: Thu, 14 Dec 2023 11:43:06 +0000