The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and other cybersecurity agencies have warned about a Russian hacking group APT29 targeting unpatched TeamCity servers since September 2023. APT29, linked to Russia’s Foreign Intelligence Service (SVR), is known for its involvement in the SolarWinds supply-chain attack and breaches of multiple U.S. federal agencies. The threat actor has been exploiting a critical TeamCity vulnerability, tracked as CVE-2023-42793 (CVSS 9.8/10), which is an authentication bypass flaw allowing remote code execution without user interaction. Successful exploitation of this vulnerability enables attackers to compromise software developers’ networks, potentially leading to further network breaches, lateral movement, and persistent access to compromised environments. The vulnerability also presents risks of software supply chain attacks via malicious code injection. Ransomware gangs and North Korean hacking groups, including Lazarus and Andariel, have also exploited this vulnerability. JetBrains, the developer of TeamCity, claims that over 98% of all TeamCity servers have been patched following the vulnerability disclosure. The vulnerability affects on-premises TeamCity instances, but the cloud version is not impacted. JetBrains has been actively contacting customers to encourage updates and has also provided a security patch for older TeamCity versions. CTIX analysts recommend that any administrators implementing TeamCity ensure that they are running the most up-to-date version to prevent exploitation.