Russian APT29 Group Targets Zimbra and JetBrains TeamCity Servers
October 13, 2024
APT29, a cyber espionage group associated with Russia, is actively exploiting vulnerabilities in Zimbra and JetBrains TeamCity servers. This large-scale operation has prompted warnings from cyber agencies in the U.S. and U.K. The FBI, NSA, Cyber National Mission Force (CNMF), and the U.K.'s National Cyber Security Centre (NCSC-UK) have jointly issued a Cybersecurity Advisory (CSA) to alert about the tactics, techniques, and procedures (TTPs) used by the Russian Federation’s Foreign Intelligence Service (SVR) in recent cyber operations.
Since April 2021, these state-sponsored hackers from Russia have been exploiting vulnerabilities, specifically CVE-2022-27924 in Zimbra for command injection to steal credentials and emails, and CVE-2023-42793 in JetBrains TeamCity for arbitrary code execution through an authentication bypass. These exploits have been used in attacks against organizations in various sectors worldwide. This has enabled the APT group to gain access to sensitive data and establish infrastructure for continuous data collection.
The joint advisory from the agencies stated, “SVR cyber actors have exploited vulnerabilities at a mass scale to target victims worldwide across a variety of sectors”. The advisory also includes a list of known vulnerabilities that need immediate attention. The agencies have warned that the Russian APT29 group possesses the ability and intention to exploit more CVEs for initial access, remote code execution, and privilege escalation. The advisory strongly recommends that organizations apply patches issued by vendors for these publicly disclosed vulnerabilities.
Related News
- CISA Issues Warning on Threat Actors Exploiting F5 BIG-IP Cookies for Network Reconnaissance
- Asian Cyber Threats Evolve: New Strategies Target Familiar Sectors
- North Korea's Lazarus Group Deploys New Kaolin RAT via Fake Job Lures
- BianLian Threat Actors Utilize JetBrains TeamCity Vulnerabilities in Ransomware Assaults
- Critical Authentication Bypass Vulnerability in TeamCity On-Premises Servers
Latest News
- CISA Issues Warning on Threat Actors Exploiting F5 BIG-IP Cookies for Network Reconnaissance
- Ransomware Gangs Exploit Critical Veeam RCE Flaw: Akira and Fog Ransomware in Focus
- Casio Hit by Underground Ransomware Gang: Stolen Data Leaked
- CISA Reports Active Exploitation of Critical Fortinet RCE Flaw
- Hackers Exploit GitHub and GitLab Platforms to Distribute Malware
Like what you see?
Get a digest of headlines, vulnerabilities, risk context, and more delivered to your inbox.
