The risk actors behind the BianLian ransomware have been noticed exploiting safety flaws in JetBrains TeamCity software program to conduct their extortion-only assaults.
In keeping with a new report from GuidePoint Safety, which responded to a current intrusion, the incident “started with the exploitation of a TeamCity server which resulted within the deployment of a PowerShell implementation of BianLian’s Go backdoor.”
BianLian emerged in June 2022, and has since pivoted completely to exfiltration-based extortion following the launch of a decryptor in January 2023.
The assault chain noticed by the cybersecurity agency entails the exploitation of a susceptible TeamCity occasion utilizing CVE-2024-27198 or CVE-2023-42793 to achieve preliminary entry to the setting, adopted by creating new customers within the construct server and executing malicious instructions for post-exploitation and lateral motion.
It is presently not clear which of the 2 flaws had been weaponized by the risk actor for infiltration.
BianLian actors are recognized to implant a customized backdoor tailor-made to every sufferer written in Go, in addition to drop distant desktop instruments like AnyDesk, Atera, SplashTop, and TeamViewer. The backdoor is tracked by Microsoft as BianDoor.
“After a number of failed makes an attempt to execute their customary Go backdoor, the risk actor pivoted to living-off-the-land and leveraged a PowerShell implementation of their backdoor, which gives an virtually equivalent performance to what they might have with their Go backdoor,” safety researchers Justin Timothy, Gabe Renfro, and Keven Murphy mentioned.
The obfuscated PowerShell backdoor (“internet.ps1”) is designed to ascertain a TCP socket for extra community communication to an actor-controlled server, permitting the distant attackers to conduct arbitrary actions on an contaminated host.
“The now-confirmed backdoor is ready to talk with the [command-and-control] server and asynchronously execute based mostly on the distant attacker’s post-exploitation aims,” the researchers mentioned.
The disclosure comes as VulnCheck detailed recent proof-of-concept (PoC) exploits for a vital safety flaw impacting Atlassian Confluence Information Heart and Confluence Server (CVE-2023-22527) that might result in distant code execution in a fileless method and cargo the Godzilla internet shell immediately into reminiscence.
The flaw has since been weaponized to deploy C3RB3R ransomware, cryptocurrency miners and distant entry trojans over the previous two months, indicating widespread exploitation within the wild.
“There’s a couple of technique to attain Rome,” VulnCheck’s Jacob Baines famous. “Whereas utilizing freemarker.template.utility.Execute seems to be the favored means of exploiting CVE-2023-22527, different extra stealthy paths generate totally different indicators.”
