aa23-347a-russian-foreign-intelligence-service-svr-exploiting-jetbrains-teamcity-cve-globally.pdf

This joint advisory attributes a widespread exploitation campaign of JetBrains TeamCity (CVE-2023-42793) to the Russian Foreign Intelligence Service (SVR/APT29). It documents successful remote code execution against unpatched TeamCity servers since September 2023, post-exploitation activities (credential theft, EDR/AV bypass via EDRSandBlast, GraphicalProton backdoors using cloud-based steganography and HTTPS C2), observed victim types, actionable IOCs (file hashes, IPs, domains), detection SIGMA/YARA examples, and mitigation/incident-response recommendations urging organizations to assume compromise if unpatched.