Thread by @MsftSecIntel

Microsoft has taken steps to disrupt and mitigate a widespread campaign by the Russian nation-state threat actor Midnight Blizzard targeting TeamCity servers using the publicly available exploit for CVE-2023-42793.

Following exploitation, Midnight Blizzard uses scheduled tasks to keep a variant of VaporRage malware persistent. The VaporRage variant, which is similar to malware deployed by the threat actor in recent phishing campaigns, abuses Microsoft OneDrive and Dropbox for C2.

Post-compromise activity includes credential theft using Mimikatz, Active Directory enumeration using DSinternals, deployment of tunneling tool rsockstun, and turning off antivirus and EDR capabilities.

In addition to disrupting the abuse of Microsoft OneDrive for command and control, Microsoft Defender Antivirus and Microsoft Defender for Endpoint protect customers against this and other Midnight Blizzard malware.

Midnight Blizzard is the latest nation-state threat actor observed exploiting the TeamCity CVE-2023-42793 vulnerability. In October, North Korean threat actors Diamond Sleet and Onyx Sleet exploited the same vulnerability in separate attacks: msft.it/6010iVpcp

Although many of the compromises appear to be opportunistic, affecting unpatched Internet-facing TeamCity servers, Microsoft continues to work with the international cybersecurity community to mitigate the potential risk to software supply chain ecosystems.

We are especially grateful to our partners in the international cybersecurity community for their collaboration on this investigation.



gov.pl/web/baza-wiedz…
cisa.gov/news-events/cy…