tag: Teamcity · 3 items
- Engineer — Act: TeamCity is core CI/CD infrastructure; active ransomware exploitation means immediate patching to the July release is overdue — also audit build logs and pipeline configurations for signs of unauthorized access or tampered artifacts.
- SOC/IR — Act: With ransomware actors actively leveraging this, hunt for unusual authentication events, anomalous build triggers, or lateral movement originating from TeamCity hosts; a compromised CI/CD server is an assume-breach scenario for the entire build pipeline.
- Leader — Act: Ransomware exploitation of CI/CD infrastructure carries supply-chain and disclosure risk — confirm whether TeamCity is run internally or by key software vendors, and brief leadership before a downstream incident surfaces the question.
- Engineer — Act: If you use JetBrains Cadence, immediately revoke and rotate all credentials and secrets used in Cadence executions; also patch any self-hosted TeamCity instances to eliminate the exploited critical vulnerability.
- SOC/IR — Act: If Cadence is in your environment, treat extracted AWS credentials as compromised and hunt for anomalous IAM activity or unexpected AWS API calls originating from CI/CD workloads since last month’s breach window.
- Leader — Act: Confirm whether your organization uses JetBrains Cadence, request an incident attestation from JetBrains, and brief leadership on potential exposure of AWS credentials and CI/CD secrets before they read it elsewhere.
- Engineer — Act: Patch on-premise JetBrains TeamCity to the fixed version immediately — CISA KEV listing confirms active exploitation, a public PoC is on GitHub, and the unauthenticated deserialization flaw carries a 9.8 CVSS score. Also audit TeamCity for unauthorized admin accounts or altered build configurations.
- SOC/IR — Act: TeamCity servers are pre-authentication targets; assume-breach sweep is warranted — hunt for anomalous build jobs, new admin accounts, or outbound connections from CI/CD hosts since patch disclosure. Map exploitation behavior to ATT&CK T1190 (Exploit Public-Facing Application) and tune EDR/SIEM rules for post-exploitation on build agents.
- Leader — Act: On-premise TeamCity RCE under active exploitation carries supply-chain risk comparable to prior CI/CD incidents — confirm this quarter whether your organization runs on-premise TeamCity instances and verify patch status with engineering before end of week.
- Signals: CVE-2026-63077 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub