Ransomware crews revive TeamCity exploits, pivot through build servers into cloud repos
Marcus Webb ·
Multiple incident response teams are warning that ransomware affiliates are again mass exploiting JetBrains TeamCity authentication bypass bugs to take over build servers, plant backdoors in compiled artifacts, and steal cloud tokens. The activity, seen in the past two weeks and detailed in technical advisories published Wednesday, centers on CVE-2023-42793 and CVE-2024-27198, both enabling unauthenticated admin creation on exposed TeamCity instances.
The timing matters because unpatched TeamCity servers remain Internet facing, and build systems sit upstream of code signing and deployment. CISA has kept both CVEs on its Known Exploited Vulnerabilities catalog, and several providers report renewed scanning and hands-on-keyboard post compromise actions this month.
Technical path and post exploitation Attackers reach the TeamCity REST API without credentials, create or elevate an administrator, and disable two factor prompts for persistence. They then deploy new build configurations or modify existing pipelines to add malicious steps that fetch second stage payloads, often via curl or PowerShell, and embed implants into release artifacts.
Investigators report consistent follow on actions. Operators enumerate Project Parameters and system properties for hard coded secrets, dump TeamCity server and agent config directories for stored credentials, and harvest personal access tokens for GitHub and GitLab. They scrape cloud provider keys from build environments, then pivot to source code managers and artifact registries to plant backdoors or exfiltrate intellectual property using Rclone or custom Go binaries.
Several cases include the drop of web shells under TeamCity’s webapps path for fallback access and scheduled tasks that re create rogue admin accounts. Lateral movement inside Windows environments relies on Impacket’s smbexec or wmiexec, with LSASS scraping for additional credentials. Linux build agents see SSH key theft and replacement of known hosts files to enable silent reuse.
Mitigation and detection JetBrains released fixes for CVE-2023-42793 and CVE-2024-27198 in 2023 and 2024, along with a security patch plugin for older releases. Enterprises should upgrade TeamCity to the latest supported build immediately, then rotate all build related secrets, personal access tokens, and cloud credentials that ever traversed the system.
Constrain TeamCity to internal networks or VPN, and enforce SSO with MFA for all admins. Audit server logs for unexpected REST API calls that create users, new or altered Build Steps, sudden enablement of Guest access, and downloads from external paste or file share domains. Hunt for web shells under TeamCity installation paths, unauthorized build agents, and recent changes to project parameters. Block outbound command and control to common exfiltration utilities, and require signed pipelines with code review to reduce silent build tampering.
The renewed focus on build systems underscores that supply chain leverage remains a preferred path for both espionage and extortion groups, which means CI CD security controls now sit alongside identity and email as first tier defenses in enterprise risk models.