North Korean state-sponsored hacking group Onyx Sleet compromised vulnerable TeamCity servers since early October 2023 · 01.10.2023
The North Korean state-sponsored hacking group Onyx Sleet has covertly infiltrated vulnerable TeamCity servers since the beginning of October 2023, Microsoft disclosed on 18 October 2023.
Operating alongside a second North Korean outfit, Diamond Sleet, the group took advantage of a vulnerability present in TeamCity servers (CVE-2023-42793). Developed by Czech software enterprise JetBrains, TeamCity is an application that continuously integrates and deploys (CI/CD) software development, popular among its users. Diamond Sleet previously has targeted media, IT services, and organisations in the defense sector in different parts of the world for espionage, data theft, monetary gain, and network destruction. Onyx Sleet has been observed to focus on defense and IT services organizations in South Korea, the United States, and India, prioritising long-term access. Reviewing the victimology for detected intrusions, Microsoft assessed both groups may have been acting opportunistically against exposed servers in this particular campaign.
After successfully compromising a TeamCity server, Onyx Sleet created a new user account and added it to the Local Administrators Group, which positioned the threat actor to initiate system discovery commands and to download payloads via PowerShell.
Sources cited by EuRepoC (10)
Show 5 more
North Korean state-sponsored hacking group Diamond Sleet compromised vulnerable TeamCity servers since early October 2023 · 01.10.2023
The North Korean hackers from Diamond Sleet, allegedly supported by the state, breached vulnerable TeamCity servers since October 2023, Microsoft detailed in report on 18 October 2023.
The group took advantage of a software flaw in TeamCity servers (CVE-2023-42793), in parallel with a second North Korean threat actor, Onyx Sleet. TeamCity is an application designed by the Czech company JetBrains for software development with continuous integration/deployment (CI/CO). Diamond Sleet previously has targeted media, IT services, and organisations in the defense sector in different parts of the world for espionage, data theft, monetary gain, and network destruction. Onyx Sleet has been observed to focus on defense and IT services organizations in South Korea, the United States, and India, prioritising long-term access. Reviewing the victimology for detected intrusions, Microsoft assessed both groups may have been acting opportunistically against exposed servers in this particular campaign.
Following the compromise of a TeamCity server, Diamond Sleet downloaded two additional payloads from hijacked infrastructure under its control, including the ForestTiger backdoor, using PowerShell to dump credentials from memory. A separate attack path also utilized PowerShell to download malicious DLLs from attacker infrastructure to conduct a DLL search-order hijacking that eventually enabled the deployment of a remote access trojan.
Sources cited by EuRepoC (12)
Show 7 more
Multiple North Korean threat actors exploiting the TeamCity CVE-2023-42793 vulnerability · 2023-10
Multiple North Korean threat actors exploiting the TeamCity CVE-2023-42793 vulnerability
https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
Multiple organizations · 18/10/2023
Microsoft says that the North Korean Lazarus and Andariel hacking groups are exploiting the CVE-2023-42793 vulnerability in TeamCity servers to deploy backdoor malware, likely to conduct software supply chain attacks. [Date Occurred: Since early October 2023; Date Discovered: Since early October 2023]
Exploitation of JetBrains TeamCity vulnerability CVE-2023-42793
Para 137: “The Lazarus Group and Andariel exploited a remote-code execution vulnerability (CVE-2023-42793) affecting the JetBrains TeamCity server, an application used for software development. While the two Democratic People’s Republic of Korea groups were reportedly exploiting the same vulnerability, they utilized different sets of tools and techniques following successful exploitation.”
Diamond Sleet exploiting JetBrains TeamCity CVE-2023-42793 · 2023-10-18T16:30:00+00:00 (published_time)
Since early October 2023, Microsoft has observed two North Korean nation-state threat actors – Diamond Sleet and Onyx Sleet – exploiting CVE-2023-42793, a remote-code execution vulnerability affecting multiple versions of JetBrains TeamCity server. ... Based on the profile of victim organizations affected by these intrusions, Microsoft assesses that the threat actors may be opportunistically compromising vulnerable servers.
Onyx Sleet exploiting JetBrains TeamCity CVE-2023-42793 · 2023-10-18T16:30:00+00:00 (published_time)
Since early October 2023, Microsoft has observed two North Korean nation-state threat actors – Diamond Sleet and Onyx Sleet – exploiting CVE-2023-42793 ... Onyx Sleet (PLUTONIUM) is a North Korean nation-state threat actor that primarily targets defense and IT services organizations in South Korea, the United States, and India.
JetBrains (TeamCity) RCE exploited by North Korean threat actors (in "8 CI/CD security best practices") · 2023-11-14T06:00:00.000Z
The JetBrains flaw, a remote code execution (RCE) vulnerability accessible to nonauthenticated users, garnered a 9.8 CVSS rating. It was actively exploited by multiple North Korean threat actors within weeks of disclosure.