Tuesday, June 25, 2024

Russian Hackers Exploiting JetBrain Vulnerability to Hack Servers

The Federal Bureau of Investigation (FBI), the National Security Agency (NSA), and other co-authoring agencies have issued a warning that Russian Foreign Intelligence Service (SVR) cyber actors are widely exploiting CVE-2023-42793, aiming their attacks at servers that host JetBrains TeamCity software since September 2023.

Cyber actors affiliated with the Foreign Intelligence Service (SVR) are also referred to as Advanced Persistent Threat 29 (APT 29), Dukes, CozyBear, and NOBELIUM/Midnight Blizzard.

According to the reports, the victims include businesses that offer software for marketing, sales, medical devices, billing, employee monitoring, financial management, hosting, tool manufacturers, small and large IT companies, and an energy trade association.

Cyber Actors Exploiting JetBrains Vulnerability

The SVR continues attacking computer companies with this newly attributed operation that targets networks that host TeamCity servers. 

The authoring agencies determine that by taking advantage of CVE2023-42793, a software development program, the SVR might gain access to victims, especially by giving the threat actors the ability to compromise the networks of several software developers.

The flaw identified as CVE2023-42793 impacts the version before 2023.05.4; it was possible to bypass authentication in JetBrains TeamCity, which might result in RCE on TeamCity Server.

Software developers manage and automate software development, compilation, testing, and release using TeamCity servers, according to the CSA. 

Malicious actors may be able to undertake malicious supply chain operations, get source code, sign certificates, disrupt software deployment and compilation procedures, and much more if they have access to a TeamCity server.

The CSA also stated threat actors carry out malicious operations like moving laterally, backdoor deployment, privilege escalation, and other actions to guarantee long-term, continuous access to the compromised network environments.

In mid-September 2023, JetBrains released a fix for this CVE, which restricted the SVR’s ability to operate to exploit unpatched TeamCity servers accessible over the Internet.

Although the authorizing agencies evaluate that the SVR is still likely in the preparation phase of its operations and has not yet utilized its access to software developers to access customer networks, the SVR’s access to these networks gives it a chance to enable difficult-to-detect command and control (C2) infrastructure.

 “Russian cyber actors continue taking advantage of known vulnerabilities for intelligence collection,” said Rob Joyce, Director of NSA’s Cybersecurity Directorate. 

“It is critical to ensure systems are patched quickly, and to implement the mitigations and use the IOCs listed in this report to hunt for adversary persistent access.”

Recommendation

Based on the malicious actions of the SVR cyber actors, the agencies advise enterprises to enhance their cyber security posture by implementing the mitigations in the alert. The mitigations are as follows:

  • Implementing a patch from JetBrains TeamCity
  • Monitor the network
  • Setting up host-based and endpoint protection solutions
  • Utilizing multi-factor authentication
  • Auditing log files
Website

Latest articles

Threat Actor Claiming a 0-day in Linux LPE Via GRUB bootloader

A new threat actor has emerged, claiming a zero-day vulnerability in the Linux GRUB...

LockBit Ransomware Group Claims Hack of US Federal Reserve

The notorious LockBit ransomware group has claimed responsibility for hacking the U.S. Federal Reserve,...

Microsoft Power BI Vulnerability Let Attackers Access Organizations Sensitive Data

A vulnerability in Microsoft Power BI allows unauthorized users to access sensitive data underlying...

Consulting Companies to Pay $11 Million Failing Cybersecurity Requirements

Two consulting companies, Guidehouse Inc. and Nan McKay and Associates, have agreed to pay...

New RAT Malware SneakyChef & SugarGhost Attack Windows Systems

Talos Intelligence has uncovered a sophisticated cyber campaign attributed to the threat actor SneakyChef....

Chinese Winnti Group Intensifies Financially Motivated Attacks

Hackers are increasingly executing financially motivated attacks and all due to the lucrative potential...

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from Promokit.eu for...
Kaaviya Balaji
Kaaviya Balaji
Kaaviya is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles