BianLian Threat Actors Exploiting JetBrains TeamCity Flaws in Ransomware Attacks

The risk actors powering the BianLian ransomware have been noticed exploiting security flaws in JetBrains TeamCity software program to carry out their extortion-only assaults.

In accordance to a new report from GuidePoint Security, which responded to a new intrusion, the incident “commenced with the exploitation of a TeamCity server which resulted in the deployment of a PowerShell implementation of BianLian’s Go backdoor.”

BianLian emerged in June 2022, and has considering that pivoted exclusively to exfiltration-centered extortion following the release of a decryptor in January 2023.

The attack chain observed by the cybersecurity organization entails the exploitation of a susceptible TeamCity instance utilizing CVE-2024-27198 or CVE-2023-42793 to get first access to the surroundings, adopted by creating new buyers in the construct server and executing destructive commands for submit-exploitation and lateral movement.

It truly is at present not distinct which of the two flaws were weaponized by the threat actor for infiltration.

BianLian actors are regarded to implant a tailor made backdoor personalized to each victim prepared in Go, as nicely as fall remote desktop resources like AnyDesk, Atera, SplashTop, and TeamViewer. The backdoor is tracked by Microsoft as BianDoor.

“After various failed tries to execute their normal Go backdoor, the threat actor pivoted to residing-off-the-land and leveraged a PowerShell implementation of their backdoor, which offers an nearly equivalent features to what they would have with their Go backdoor,” security scientists Justin Timothy, Gabe Renfro, and Keven Murphy stated.

The obfuscated PowerShell backdoor (“web.ps1”) is built to establish a TCP socket for further network interaction to an actor-managed server, allowing for the distant attackers to carry out arbitrary actions on an infected host.

“The now-confirmed backdoor is equipped to talk with the [command-and-control] server and asynchronously execute based mostly on the remote attacker’s write-up-exploitation objectives,” the researchers reported.

The disclosure arrives as VulnCheck detailed contemporary evidence-of-thought (PoC) exploits for a critical security flaw impacting Atlassian Confluence Information Center and Confluence Server (CVE-2023-22527) that could direct to distant code execution in a fileless method and load the Godzilla web shell right into memory.

The flaw has considering that been weaponized to deploy C3RB3R ransomware, cryptocurrency miners and distant accessibility trojans more than the past two months, indicating prevalent exploitation in the wild.

“You can find much more than a single way to arrive at Rome,” VulnCheck’s Jacob Baines observed. “While utilizing freemarker.template.utility.Execute appears to be the popular way of exploiting CVE-2023-22527, other a lot more stealthy paths produce distinctive indicators.”

Discovered this write-up exciting? Observe us on Twitter  and LinkedIn to study additional special content material we write-up.

Some parts of this article are sourced from:
thehackernews.com