sechub.in Open in urlscan Pro
2606:4700:3031::6815:5625  Public Scan

Form analysis
0 forms found in the DOM

Text Content

Sechub
 * 首页


收藏

历史
投稿


RUSSIA-LINKED GROUP APT29 IS TARGETING ZIMBRA AND JETBRAINS TEAMCITY SERVERS ON
A LARGE SCALE

Security Affairs 2024-10-13 12:38:19 apt · breaking news · apt29
收藏


U.S. AND U.K. CYBER AGENCIES WARN THAT RUSSIA-LINKED GROUP APT29 IS TARGETING
VULNERABLE ZIMBRA AND JETBRAINS TEAMCITY SERVERS ON A LARGE SCALE.

Russia-linked cyber espionage group APT29 (aka SVR group, BlueBravo, Cozy
Bear, Nobelium, Midnight Blizzard, and The Dukes) target vulnerable Zimbra and
JetBrains TeamCity servers as part of a mass scale campaign, U.S. and U.K. cyber
agencies warned.

The Federal Bureau of Investigation (FBI), the National Security Agency (NSA),
Cyber National Mission Force (CNMF), and the United Kingdom’s National Cyber
Security Centre (NCSC-UK) released a joint Cybersecurity Advisory (CSA) to warn
of the tactics, techniques, and procedures (TTPs) employed by the Russian
Federation’s Foreign Intelligence Service (SVR) in recent cyber operations.

Since April 2021, Russian state-sponsored hackers have exploited
vulnerabilities, including Zimbra’s CVE-2022-27924 for injecting commands to
access credentials and emails, and JetBrains TeamCity’s CVE-2023-42793 for
arbitrary code execution through an authentication bypass. The threat actors
used exploits for the above issues in attacks against organizations in various
sectors globally, allowing the APT group to access sensitive data and deploy
infrastructure for ongoing data collection.

“SVR cyber actors have exploited vulnerabilities at a mass scale to target
victims worldwide across a variety of sectors” reads the joint advisory.

The joint advisory includes a list of known vulnerabilities that should be
addressed as soon as possible.

The government agencies warn that the Russian APT29 group has the capability and
intent to exploit more CVEs for initial access, remote code execution, and
privilege escalation. The cyber agencies recommend organizations apply
vendor-issued patches for these publicly disclosed vulnerabilities.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Russia)

原始链接：
https://securityaffairs.com/169708/apt/apt29-target-zimbra-and-jetbrains-teamcity.html
侵权请联系站方： admin@sechub.in


目录

 * U.S. and U.K. cyber agencies warn that Russia-linked group APT29 is targeting
   vulnerable Zimbra and JetBrains TeamCity servers on a large scale.




最新

 * Digital Echo Chambers and Erosion of Trust – Key Threats to the US Elections
 * U.S. CISA adds Microsoft SharePoint flaw to its Known Exploited
   Vulnerabilities catalog
 * Crooks are targeting Docker API servers to deploy SRBMiner
 * Why DSPM is Essential for Achieving Data Privacy in 2024
 * SEC fined 4 companies for misleading disclosures about the impact of the
   SolarWinds attack
 * Samsung zero-day flaw actively exploited in the wild
 * Experts warn of a new wave of Bumblebee malware attacks
 * U.S. CISA adds ScienceLogic SL1 flaw to its Known Exploited Vulnerabilities
   catalog


相关推荐

换一批
 * Russia-linked group APT29 is targeting Zimbra and JetBrains TeamCity servers
   on a large scale
 * Russia-linked APT29 spotted targeting JetBrains TeamCity servers
 * Russia-linked APT29 spotted targeting JetBrains TeamCity servers
 * Russia-linked APT29 switched to targeting cloud services
 * Russia-linked APT29 switched to targeting cloud services
 * US, UK warn of Russian APT29 hackers targeting Zimbra, TeamCity servers
 * The Russia-linked APT29 is behind recent attacks targeting NATO and EU
 * Russian SVR-Linked APT29 Targets JetBrains TeamCity Servers in Ongoing
   Attacks
 * Russia-linked APT29 targets diplomatic and government organizations
 * Russia-linked APT29 group changes TTPs following April advisories
 * Russia-linked APT29 targeted German political parties with WINELOADER
   backdoor
 * Russia-linked APT29 targeted German political parties with WINELOADER
   backdoor
 * Russia-linked APT29 relies on Google Drive, Dropbox to evade detection
 * Russia-linked APT29 abuses EU information exchange systems in recent attacks
 * Russia-linked group APT29 likely breached TeamViewer’s corporate network
 * Russia-linked group APT29 likely breached TeamViewer’s corporate network