BianLian Threat Actors Exploiting JetBrains TeamCity Flaws in Ransomware Attacks

The risk actors behind the BianLian ransomware have been observed exploiting security flaws in JetBrains TeamCity program to conduct their extortion-only attacks.

In accordance to a new report from GuidePoint Security, which responded to a modern intrusion, the incident “commenced with the exploitation of a TeamCity server which resulted in the deployment of a PowerShell implementation of BianLian’s Go backdoor.”

BianLian emerged in June 2022, and has considering the fact that pivoted exclusively to exfiltration-based mostly extortion following the release of a decryptor in January 2023.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

The attack chain noticed by the cybersecurity agency entails the exploitation of a vulnerable TeamCity occasion employing CVE-2024-27198 or CVE-2023-42793 to gain first access to the environment, adopted by developing new customers in the develop server and executing destructive instructions for publish-exploitation and lateral movement.

It is at the moment not apparent which of the two flaws ended up weaponized by the threat actor for infiltration.

BianLian actors are acknowledged to implant a custom backdoor tailored to each target prepared in Go, as very well as fall distant desktop tools like AnyDesk, Atera, SplashTop, and TeamViewer. The backdoor is tracked by Microsoft as BianDoor.

“Following numerous failed tries to execute their normal Go backdoor, the threat actor pivoted to living-off-the-land and leveraged a PowerShell implementation of their backdoor, which delivers an practically equivalent features to what they would have with their Go backdoor,” security researchers Justin Timothy, Gabe Renfro, and Keven Murphy mentioned.

The obfuscated PowerShell backdoor (“web.ps1”) is made to create a TCP socket for supplemental network conversation to an actor-managed server, allowing for the distant attackers to conduct arbitrary actions on an infected host.

“The now-verified backdoor is able to communicate with the [command-and-control] server and asynchronously execute dependent on the remote attacker’s post-exploitation aims,” the researchers said.

The disclosure will come as VulnCheck detailed refreshing proof-of-principle (PoC) exploits for a critical security flaw impacting Atlassian Confluence Details Middle and Confluence Server (CVE-2023-22527) that could guide to distant code execution in a fileless method and load the Godzilla web shell immediately into memory.

The flaw has considering that been weaponized to deploy C3RB3R ransomware, cryptocurrency miners and remote obtain trojans in excess of the previous two months, indicating common exploitation in the wild.

“There is far more than one particular way to achieve Rome,” VulnCheck’s Jacob Baines famous. “Whilst applying freemarker.template.utility.Execute appears to be the popular way of exploiting CVE-2023-22527, other extra stealthy paths generate unique indicators.”

Discovered this report interesting? Stick to us on Twitter  and LinkedIn to go through more special material we post.