Full Report
On 2024-03-19, a campaign was reported, involving an unknown actor, gaining initial access via 1-day vulnerability, while using LOLBin abuse, targeting TeamCity to achieve Resource hijacking, RansomOp. The following tools were observed: Jasmin, XMRig, Cobalt Strike, SparkRAT.
Analysis Summary
# Incident Report: TeamCity Vulnerability Exploitation Campaign
## Executive Summary
In March 2024, an unknown threat actor exploited 1-day vulnerabilities in JetBrains TeamCity servers to gain unauthorized access to corporate environments. The campaign utilized a sophisticated mix of Living-off-the-Land Binaries (LOLBins) and diverse malware to achieve both cryptocurrency hijacking and ransomware operations. The impact ranged from resource exhaustion to complete system encryption across multiple sectors.
## Incident Details
- **Discovery Date:** 2024-03-19
- **Incident Date:** Circa March 2024 (Ongoing at time of report)
- **Affected Organization:** Multiple organizations using JetBrains TeamCity
- **Sector:** Technology, Software Development, and general enterprise
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Early March 2024
- **Vector:** CVE-2024-27198 / CVE-2024-27199 (1-day vulnerabilities)
- **Details:** The threat actor exploited authentication bypass vulnerabilities in TeamCity web servers to create administrative accounts or execute arbitrary code.
### Lateral Movement
- **Details:** After establishing a foothold, the actor deployed **Cobalt Strike** beacons and **SparkRAT** to navigate the internal network, utilizing **LOLBins** (legitimate system tools) to blend in with normal administrative traffic and bypass security controls.
### Data Exfiltration/Impact
- **Details:** The primary impacts were **Resource Hijacking** (deployment of XMRig miners) and **RansomOp** (deployment of Jasmin Ransomware). While specific data volumes are undisclosed, the presence of Cobalt Strike suggests potential reconnaissance for data theft.
### Detection & Response
- **How it was discovered:** Security researchers identified unusual process trees originating from TeamCity service accounts (e.g., `cmd.exe` or `powershell.exe` spawning from the TeamCity web service).
- **Response actions taken:** Patching of TeamCity instances, isolation of affected build servers, and termination of malicious C2 (Command and Control) sessions.
## Attack Methodology
- **Initial Access:** Exploitation of 1-day vulnerabilities in JetBrains TeamCity (Authentication Bypass).
- **Persistence:** Creation of unauthorized administrative users; installation of **SparkRAT** for remote persistence.
- **Privilege Escalation:** Direct exploitation of the TeamCity web service which often runs with high-level system permissions.
- **Defense Evasion:** Use of **LOLBin abuse** to execute commands; deployment of the **Jasmin** ransomware (often used for "educational" or disguised purposes).
- **Credential Access:** Likely memory scraping via Cobalt Strike (implied by toolset).
- **Discovery:** Internal network scanning via built-in system tools.
- **Lateral Movement:** SMB/WMI movement via **Cobalt Strike**.
- **Impact:** Deployment of **XMRig** for Monero mining (Resource Hijacking) and **Jasmin** for file encryption (Ransomware).
## Impact Assessment
- **Financial:** High; includes remediation costs, productivity loss during build server downtime, and potential ransom demands.
- **Data Breach:** Risk of Source Code theft given the target (CI/CD pipelines).
- **Operational:** Critical; disruption of the software development lifecycle (SDLC) and CI/CD pipelines.
- **Reputational:** High; loss of trust in the integrity of the software build process.
## Indicators of Compromise
- **Network indicators:**
- `[C2 Infrastructure - defanged]`
- `hxxp[://]unattributed-malicious-ip-address[/]cobaltstrike`
- `hxxps[://]miner-pool-domain[.]com`
- **File indicators:**
- `xmrig.exe` (MD5/SHA256 varied)
- `SparkRAT.exe`
- `Jasmin_Ransomware_Payload`
- **Behavioral indicators:**
- Unauthorized creation of admin accounts in TeamCity.
- `TeamCity.exe` spawning `powershell.exe` or `certutil.exe`.
- Excessive CPU usage on build servers (cryptomining).
## Response Actions
- **Containment:** Disconnected affected TeamCity servers from the internet; disabled compromised service accounts.
- **Eradication:** Wiped and rebuilt compromised build agents; removed all unauthorized admin accounts.
- **Recovery:** Restored server configurations from backups post-patching.
## Lessons Learned
- **Patch Management:** The speed between "1-day" vulnerability disclosure and active exploitation remains extremely narrow, requiring near-instantaneous patching of internet-facing assets.
- **Service Account Hardening:** Modern CI/CD tools like TeamCity are high-value targets; they should never run with more privileges than necessary and should be monitored for anomalous child processes.
## Recommendations
- **Immediate Patching:** Update JetBrains TeamCity to the latest version to mitigate CVE-2024-27198 and CVE-2024-27199.
- **Monitor Build Servers:** Implement EDR (Endpoint Detection and Response) on all build agents to detect LOLBin abuse.
- **Network Segmentation:** Ensure CI/CD servers are isolated from the general corporate network and have restricted outbound internet access.