Microsoft Warns of North Korean Attacks Exploiting JetBrains TeamCity Flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-42793 | Authentication bypass in JetBrains TeamCity enables unauthenticated RCE JetBrains TeamCity Server, a widely used CI/CD build server, contains an authentication bypass vulnerability (CWE-288) that lets a remote, unauthenticated attacker gain administrative access without valid credentials. By sending crafted requests to the TeamCity server over the network, the attacker bypasses authentication and can then execute arbitrary code on the server via administrative and build features, achieving full remote code execution. An attacker gains control of the build server and, with it, access to source code, build artifacts, stored secrets and credentials, and a foothold for lateral movement or ransomware deployment. Any organization running an affected TeamCity Server is affected, especially instances reachable from the internet. Exploitation is confirmed in the wild: CISA added the flaw to its KEV catalog on 2023-10-04 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days. Do: Upgrade TeamCity Server to 2023.05.4 or later per JetBrains' instructions, or apply vendor mitigations or discontinue use if patching is not possible (per the CISA KEV required action). Also take unpatched instances off the public internet, and hunt for signs of compromise such as unauthorized administrator accounts, unexpected changes in audit logs and build configurations, and stored secrets or tokens that may have been stolen, given known ransomware exploitation. | 9.8 | 100% | KEV ransomware PoC ×2 |
| largeTens of thousands of TeamCity Server deployments, of which several thousand are internet-exposed |
Full article625 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananOct 19, 2023
North Korean threat actors are actively exploiting a critical security flaw in JetBrains TeamCity to opportunistically breach vulnerable servers, according to Microsoft.
The attacks, which entail the exploitation of CVE-2023-42793 (CVSS score: 9.8), have been attributed to Diamond Sleet (aka Labyrinth Chollima) and Onyx Sleet (aka Andariel or Silent Chollima).
It's worth noting that both the threat activity clusters are part of the infamous North Korean nation-state actor known as Lazarus Group.
In one of the two attack paths employed by Diamond Sleet, a successful compromise of TeamCity servers is followed by the deployment of a known implant called ForestTiger from legitimate infrastructure previously compromised by the threat actor.
A second variant of the attacks leverages the initial foothold to retrieve a malicious DLL (DSROLE.dll aka RollSling or Version.dll or FeedLoad) that's loaded by means of a technique referred to as DLL search-order hijacking to either execute a next-stage payload or a remote access trojan (RAT).
Microsoft said it witnessed the adversary leveraging a combination of tools and techniques from both attack sequences in certain instances.
The intrusions mounted by Onyx Sleet, on the other hand, use the access afforded by the exploitation of the JetBrains TeamCity bug to create a new user account named krtbgt that's likely intended to impersonate the Kerberos Ticket Granting Ticket.
"After creating the account, the threat actor adds it to the Local Administrators Group through net use," Microsoft said. "The threat actor also runs several system discovery commands on compromised systems."
The attacks subsequently lead to the deployment of a custom proxy tool dubbed HazyLoad that helps establish a persistent connection between the compromised host and attacker-controlled infrastructure.
Another notable post-compromise action is the use of the attacker-controlled krtbgt account to sign into the compromised device via remote desktop protocol (RDP) and terminating the TeamCity service in a bid to prevent access by other threat actors.
Over the years, the Lazarus group has established itself as one of the most pernicious and sophisticated advanced persistent threat (APT) groups currently active, orchestrating financial crime and espionage attacks in equal measure via cryptocurrency heists and supply chain attacks.
"We certainly believe that North Korean hacking of cryptocurrency around infrastructure, around the world – including in Singapore, Vietnam, and Hong Kong – is a major source of revenue for the regime that's used to finance the advancing of the missile program and the far greater number of launches we have seen in the last year," U.S. Deputy National Security Advisor, Anne Neuberger, said.
The development comes as the AhnLab Security Emergency Response Center (ASEC) detailed the Lazarus Group's use of malware families such as Volgmer and Scout that act as a conduit for serving backdoors for controlling the infected systems.
"The Lazarus group is one of the very dangerous groups that are highly active worldwide, using various attack vectors such as spear-phishing and supply chain attacks," the South Korean cybersecurity firm said, implicating the hacking crew to another campaign codenamed Operation Dream Magic.
This involves mounting watering hole attacks by inserting a rogue link within a specific article on an unspecified news website that weaponizes security flaws in INISAFE and MagicLine products to activate the infections, a tactic previously associated with the Lazarus Group.
In a further sign of North Korea's evolving offensive programs, ASEC has attributed another threat actor known as Kimsuky (aka APT43) to a fresh set of spear-phishing attacks that utilize the BabyShark malware to install a motley slate of remote desktop tools and VNC software (i.e., TightVNC and TinyNuke) to commandeer victim systems and exfiltrate information.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/10/microsoft-warns-of-north-korean-attacks.html