Russian state-sponsored hackers have been exploiting CVE-2023-42793 to target unpatched, internet-facing JetBrains TeamCity servers since September 2023, US, UK and Polish cybersecurity and law enforcement authorities have warned.
APT 29, believed to be associated with the Russian Foreign Intelligence Service, has been active since 2013.
The group is known for targeting a wide variety of organizations: government agencies, think tanks, political organizations, diplomatic agencies, biomedical and energy companies, as well as IT companies.
Their main goal seems to be the collection of foreign intelligence.
Fortinet has also published details about their investigation of a recent intrusion at a US-based organization in the biomedical manufacturing industry, which they believe may be the work of APT 29.
In these latest attacks, APT 29 has exploited CVE-2023-42793, an authentication bypass vulnerability in the TeamCity CI/CD platform that can lead to RCE. Patches for it have been released in mid-September 2023, but there are still nearly 800 JetBrains TeamCity unpatched instances worldwide, according to the Shadowserver Foundation.
After gaining initial access by exploiting the vulnerability, the hackers performed host and network reconnaissance, escalated their privileges, performed lateral moves, deployed backdoors, and took steps to ensure long-term access to the compromised network environments.
Still, they say that APT 29 has not yet used its accesses to software developers to access customer networks.
The agencies' advisory contains indicators of compromise and lays out the techniques used by the attackers.
Security teams at organizations that have failed to patch their TeamCity servers in time should check for signs of intrusion, both by APT 29 and other attackers.
According to Microsoft, since early October Korea-backed hacking groups Lazarus and Andariel have also been exploiting CVE-2023-42793 to gain permanent access to compromised networks and use them for further operations.
This Cyber News was published on www.helpnetsecurity.com. Publication date: Thu, 14 Dec 2023 13:13:20 +0000