Thursday, February 22, 2024

Russian Hackers Exploiting JetBrain Vulnerability to Hack Servers

The Federal Bureau of Investigation (FBI), the National Security Agency (NSA), and other co-authoring agencies have issued a warning that Russian Foreign Intelligence Service (SVR) cyber actors are widely exploiting CVE-2023-42793, aiming their attacks at servers that host JetBrains TeamCity software since September 2023.

Cyber actors affiliated with the Foreign Intelligence Service (SVR) are also referred to as Advanced Persistent Threat 29 (APT 29), Dukes, CozyBear, and NOBELIUM/Midnight Blizzard.

According to the reports, the victims include businesses that offer software for marketing, sales, medical devices, billing, employee monitoring, financial management, hosting, tool manufacturers, small and large IT companies, and an energy trade association.

Cyber Actors Exploiting JetBrains Vulnerability

The SVR continues attacking computer companies with this newly attributed operation that targets networks that host TeamCity servers. 

The authoring agencies determine that by taking advantage of CVE2023-42793, a software development program, the SVR might gain access to victims, especially by giving the threat actors the ability to compromise the networks of several software developers.

The flaw identified as CVE2023-42793 impacts the version before 2023.05.4; it was possible to bypass authentication in JetBrains TeamCity, which might result in RCE on TeamCity Server.

Software developers manage and automate software development, compilation, testing, and release using TeamCity servers, according to the CSA. 

Malicious actors may be able to undertake malicious supply chain operations, get source code, sign certificates, disrupt software deployment and compilation procedures, and much more if they have access to a TeamCity server.

The CSA also stated threat actors carry out malicious operations like moving laterally, backdoor deployment, privilege escalation, and other actions to guarantee long-term, continuous access to the compromised network environments.

In mid-September 2023, JetBrains released a fix for this CVE, which restricted the SVR’s ability to operate to exploit unpatched TeamCity servers accessible over the Internet.

Although the authorizing agencies evaluate that the SVR is still likely in the preparation phase of its operations and has not yet utilized its access to software developers to access customer networks, the SVR’s access to these networks gives it a chance to enable difficult-to-detect command and control (C2) infrastructure.

 “Russian cyber actors continue taking advantage of known vulnerabilities for intelligence collection,” said Rob Joyce, Director of NSA’s Cybersecurity Directorate. 

“It is critical to ensure systems are patched quickly, and to implement the mitigations and use the IOCs listed in this report to hunt for adversary persistent access.”

Recommendation

Based on the malicious actions of the SVR cyber actors, the agencies advise enterprises to enhance their cyber security posture by implementing the mitigations in the alert. The mitigations are as follows:

  • Implementing a patch from JetBrains TeamCity
  • Monitor the network
  • Setting up host-based and endpoint protection solutions
  • Utilizing multi-factor authentication
  • Auditing log files
Website

Latest articles

Leak of China’s Hacking Documentation Stunned Researchers

In a startling revelation that has sent shockwaves through the cybersecurity community, a massive...

Apex Code Vulnerabilities Let Hackers Steal Salesforce Data

Hackers target Apex code vulnerabilities in Salesforce to exploit security weaknesses, gain unauthorized access...

Beware of New AsukaStealer Steal Browser Passwords & Desktop Screens

An updated version of the ObserverStealer known as AsukaStealer was observed to be advertised as...

US to Pay $15M for Info About Lockbit Ransomware Operator Data

In a significant move against cybercrime, the U.S. government has announced a bounty of...

Earth Preta Hackers Abuses Google Drive to Deploy DOPLUGS Malware

Threat actors abuse Google Drive for several malicious activities due to its widespread use,...

Swiggy Account Hacked, Hackers Placed Orders Worth Rs 97,000

In a startling incident underscoring the growing menace of cybercrime, a woman's Swiggy account...

Beware of VietCredCare Malware that Steals businesses’ Facebook Accounts

A new cybersecurity threat targeting Facebook advertisers in Vietnam, known as VietCredCare, has emerged....
Kaaviya Balaji
Kaaviya Balaji
Kaaviya is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles