Pulse Detail — Threat Intelligence

PULSE NAME

Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally | CISA

WHITE Diplomatic Orbiter AlienVault 2023-12-13 Modified: 2024-01-12

IOCs

MEDIUM VOLUME

Russia's foreign intelligence service (SVR) is targeting servers hosting TeamCity software, according to the CISA Cybersecurity and Infrastructure Security Agency (CISA), a US government agency that oversees cyber security.

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1003 T1020 T1027 T1033 T1036 T1041 T1046 T1047 T1049 T1053 T1055 T1057 T1059 T1068 T1098 T1190 T1203 T1210 T1505 T1547 T1555 T1558 T1562 T1564 T1567 T1568 T1572 T1574 T1590 T1592 T1531 T1140 T1550 T1195 T1102

MALWARE FAMILIES

GraphicalProton SVR Cyber

Indicators of Compromise (2 / 38 total)

All URL CVE FileHash-MD5 FileHash-SHA1 FileHash-SHA256 YARA domain

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-MD5	2d8e4f38b36c334d0a32a7324832501d	MD5 of 01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd	2023-12-13
FileHash-MD5	c996d7971c49252c582171d9380360f2	MD5 of 0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5	2023-12-13

References (1)

↗ https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a