Poisoned Pipeline / Incidents / AS299
North Korean actors exploited TeamCity CVE-2023-42793
Microsoft Threat Intelligence, 18 October 2023: since early October,
Diamond Sleet and Onyx Sleet exploited CVE-2023-42793, a remote-code
execution bug in multiple versions of JetBrains TeamCity server. After
exploitation the two actors used different tools. Microsoft assessed the
victim set looked opportunistic, and both actors deployed malware that
can keep access on the compromised server. Diamond Sleet has previously
turned build-environment access into a software supply-chain compromise;
Microsoft called that the reason this CI-server exploitation is high
risk. This write-up documents the CI-server intrusion. It does not
describe a poisoned customer artifact from this wave.
Mapped techniques
- T0135 Vulnerable CICD system
supply-chain TeamCity servers
Unauthenticated remote code execution on the TeamCity server was
the initial access Microsoft observed.
Framework gaps noted
- The Mercari matrix's "compromise the CI/CD server" fits. This catalogue has no separate technique for implanting a backdoor on the CI host after that RCE. Microsoft did not report a trojanized build shipped from these servers in this post.