CISA and Partners Release Advisory on Russian SVR-affiliated Cyber Actors Exploiting CVE-2023-42793

Summary:

A joint Cybersecurity Advisory (CSA) was released by CISA, FBI, NSA, Polish Military Counterintelligence Service, CERT Polska, and the UK's National Cyber Security Centre, warning of a global security threat. Russian Foreign Intelligence Service (SVR)-affiliated cyber actors have been targeting servers hosting JetBrains TeamCity software since September 2023, bypassing authorization and executing arbitrary code. The advisory provides information on the compromise, IOCs, SIGMA, and YARA rules, and recommends mitigations and rules for network defenders and organizations.