iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Russian Foreign Intelligence Service (SVR)-linked actors exploited a critical vulnerability in internet-connected JetBrains TeamCity On-Premises servers beginning in September 2023, according to a joint government advisory published on December 13, 2023. The advisory describes exploitation at scale, but campaign-specific sources identify technology and software organizations as victims—not government agencies. The sources reviewed do not confirm a government agency as a direct victim of this TeamCity operation.
What happened in the TeamCity campaign?
A joint advisory from the FBI, CISA, NSA, Poland’s SKW and CERT Polska, and the UK’s NCSC assessed that SVR-affiliated actors had targeted TeamCity servers since September 2023. The actors are also known as APT29, the Dukes, CozyBear, and NOBELIUM or Midnight Blizzard. The advisory says they used authorization bypass and arbitrary code execution to compromise servers. CISA’s joint advisory describes the campaign and its techniques.
TeamCity helps organizations compile, build, test, and release software. Access to a developer’s build server can expose source code and signing certificates or allow interference with build and deployment processes. Those capabilities create a potential software supply-chain risk. The advisory describes that risk; it does not establish that attackers accessed downstream customer networks in this operation.
Were government agencies confirmed victims?
No government agency is identified as a confirmed direct victim in the campaign-specific victim examples reviewed. The NSA’s summary instead names an energy trade association; companies in software for billing, medical devices, customer care, employee monitoring, financial management, marketing, sales, and video games; hosting companies; tool manufacturers; and IT companies of varying sizes. The NSA’s campaign announcement provides those categories.
#1 Best Overall
SVR actors have targeted government agencies in other operations. That broader history is context, not evidence that a government agency was compromised through this particular TeamCity campaign. The FBI-hosted advisory’s threat overview describes the wider targeting history: joint advisory threat overview.
Which TeamCity installations were vulnerable?
CVE-2023-42793 affected TeamCity On-Premises. JetBrains says TeamCity Cloud was not affected. An unauthenticated attacker who could reach a vulnerable server over HTTP(S) could execute code remotely and gain administrative control. JetBrains’ vulnerability post-mortem explains the affected deployment and impact.
JetBrains received Sonar’s report on September 6, 2023, and released TeamCity 2023.05.4 with a fix on September 18. For customers unable to upgrade, JetBrains provided a security patch plugin for older TeamCity versions 8.0 and later. A fixed version or applied plugin addresses this vulnerability; neither fact by itself establishes whether an attacker accessed the server before mitigation.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How do I tell whether my TeamCity server was affected?
Check the deployment type, version, network exposure, and timing of mitigation. Then investigate for signs of prior access if the server may have been vulnerable and reachable. Use the following distinctions:
Rank #3
- TeamCity Cloud: JetBrains says this service was not affected by CVE-2023-42793.
- TeamCity On-Premises, fixed before exposure: Version 2023.05.4 or later includes the fix. JetBrains also supplied a patch plugin for older versions.
- Vulnerable On-Premises server reachable over HTTP(S): It met the conditions for unauthenticated remote code execution and administrative control. Exposure alone does not prove compromise.
- Server patched after it was exposed: The patch prevents exploitation of this vulnerability going forward, but does not answer whether access occurred earlier.
What should I do if my server was exposed?
- Mitigate the vulnerability. Upgrade TeamCity On-Premises to 2023.05.4 or later, or apply JetBrains’ security patch plugin if upgrading is not possible. Follow the vendor’s upgrade and patch guidance.
- Temporarily isolate a server you cannot patch. If an internet-accessible server cannot be updated or patched immediately, JetBrains recommends making it inaccessible until mitigation and compromise investigation are complete. JetBrains’ December update covers response guidance.
- Investigate for earlier compromise. Review the specific TeamCity instance using CISA indicators and detection methods, plus Microsoft indicators for Windows-based TeamCity servers and build agents. JetBrains notes that the indicators are not exhaustive.
- Review the surrounding environment. The NSA also recommends host-based and endpoint protection, multifactor authentication, and auditing log files. Prioritize the TeamCity host and build agents, and assess potentially exposed source code, signing certificates, and build or release processes as part of the investigation.
“It is critical to ensure systems are patched quickly, and to implement the mitigations and use the IOCs listed in this report to hunt for adversary persistent access,” said Rob Joyce, then Director of the NSA’s Cybersecurity Directorate. The statement accompanied the NSA’s December 13, 2023 announcement.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
