Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally

Summary:

Russian Foreign Intelligence Service (SVR) cyber actors, also known as Advanced Persistent Threat 29 (APT 29), are exploiting a security vulnerability in JetBrains TeamCity software to gain arbitrary code execution on the server. The SVR has compromised several servers hosting TeamCity software, allowing them to access sensitive data and escalate privileges, move laterally, deploy additional backdoors, and take other steps to ensure persistent and long-term access to the compromised networks. The SVR used the "rr.exe"" tool to establish a tunnel to their C2 infrastructure and WMIC to facilitate lateral movement and Registry modifications.