Ransomware Gangs Exploit Critical TeamCity Auth Bypass Flaw

Executive Summary

The United States Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency update to its Known Exploited Vulnerabilities (KEV) catalog, warning federal civilian executive agencies that ransomware syndicates are now actively weaponizing a critical security vulnerability affecting JetBrains TeamCity On-Premises CI/CD servers.

The vulnerability, cataloged as CVE-2026-63077 with a critical CVSS v3.1 rating of 9.8, is an unauthenticated authentication bypass weakness residing within the TeamCity build agent polling protocol. Unauthenticated remote adversaries possessing HTTP(S) network access can exploit the communication mechanism to bypass authentication controls and execute arbitrary operating system commands with the elevated privileges of the TeamCity server process.

JetBrains TeamCity is deployed across more than 30,000 corporate engineering organizations worldwide, including Fortune 500 enterprises such as Citibank, Tesla, and Amazon Games. Because CI/CD servers store sensitive repository access tokens, cloud service keys, and production deployment credentials, compromising the build master grants adversaries immediate capability to pivot into production environments and deploy ransomware across enterprise networks.

Technical Vulnerability Analysis & Attack Chain

The exploit sequence bypasses standard perimeter access controls by impersonating build agent coordination routines:

1. Internet-Facing Port Discovery: Ransomware affiliates deploy automated port scanners scanning for exposed TeamCity web interfaces (default TCP ports 8111 and 443). Telemetry from Shadowserver indicates over 160 Internet-exposed TeamCity servers remain unpatched against the vulnerability.
2. Protocol Impersonation & Auth Bypass: The attacker sends crafted HTTP requests mimicking legitimate build agent polling messages to the TeamCity server. Flaws in the protocol's message validation permit the attacker to bypass authentication filters entirely without possessing valid agent certificates or user credentials.
3. Arbitrary Command Execution: Exploiting server-side command processing routines, the adversary injects arbitrary shell commands into the server execution queue. The server executes these commands under the security context of the teamcity system user, enabling the attacker to spawn interactive reverse shells.
4. Credential Harvesting & CI/CD Poisoning: With host access established, the adversary harvests stored Version Control System (VCS) roots, hardcoded AWS/Azure service principal keys, and deployment SSH certificates. Intruders modify project build configurations to insert secondary backdoors into software build artifacts.
5. Ransomware Deployment & Double Extortion: Threat actors utilize the harvested cloud and enterprise credentials to move laterally into production clusters, disabling backup routines and deploying ransomware payloads to encrypt corporate hypervisors and file servers.

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

Threat Actor Profile & Campaign Attribution

CISA's explicit tagging of CVE-2026-63077 as exploited by ransomware gangs indicates that multiple financially motivated cybercrime cartels have operationalized the exploit. Historically, initial access brokers (IABs) target developer infrastructure to sell administrative footholds on dark web marketplaces.

CI/CD vulnerabilities are also heavily targeted by state-sponsored actors. In October 2024, CISA and the UK NCSC issued joint advisories detailing how Russian Foreign Intelligence Service (SVR / APT29) hackers exploited prior TeamCity vulnerabilities at mass scale to compromise software supply chains. Since October 2023, CISA has added four distinct TeamCity vulnerabilities to its KEV catalog, all of which have been weaponized in ransomware and cyber espionage operations.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

• Upgrade TeamCity Immediately: Upgrade all TeamCity On-Premises servers immediately to version 2025.11.7 or 2026.1.3, which completely remediate the authentication bypass logic.
• Network Isolation: If patching cannot be deployed immediately, restrict all inbound HTTP(S) access to the TeamCity server strictly to internal private subnets or via verified corporate VPNs. Never expose build management interfaces directly to the public Internet.
• Rotate All Build Secrets: Because CVE-2026-63077 allows unauthenticated adversaries to extract stored build configurations, organizations with exposed servers must assume compromise and immediately rotate all cloud access keys, private SSH keys, and Git access tokens stored within TeamCity.

2. Network & Perimeter Defenses

• Inspect inbound HTTP traffic on TeamCity ports for anomalous POST requests directed to agent communication endpoints containing shell commands or suspicious parameter structures.
• Restrict outbound internet egress from TeamCity build servers using firewall egress filters, blocking unexpected connections to unapproved external IP addresses or newly registered domains.
• Implement strict network segmentation separating build runners and CI/CD controllers from internal corporate active directory and production database subnets.

3. Endpoint Detection & Hunting Query

title: TeamCity Server Process Spawning Interactive Shell or Ransomware Binary
id: 8b1f3c24-5d9a-4e78-9012-123456789abc
status: experimental
description: Detects suspicious child process creation (cmd.exe, powershell.exe, bash, certutil) spawned directly by the TeamCity server process.
author: CyberNewsAI Threat Intelligence
references:
  - https://www.bleepingcomputer.com/news/security/cisa-ransomware-gangs-now-exploiting-critical-teamcity-flaw/
tags:
  - attack.t1190
  - attack.t1059
  - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\TeamCity\bin\teamcity-server.exe'
      - '\TeamCity\bin\tomcat8.exe'
      - '\TeamCity\bin\tomcat9.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\pwsh.exe'
      - '\certutil.exe'
      - '\curl.exe'
      - '\vssadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Authorized custom build runner hooks configured by verified TeamCity administrators
level: critical

// Microsoft Sentinel / Defender Hunting Query: Detect Anomalous Shell Execution from TeamCity Server
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessCommandLine has_any ("teamcity", "JetBrains", "tomcat")
| where FileName in~ ("powershell.exe", "cmd.exe", "sh", "bash", "vssadmin.exe", "wbadmin.exe")
| where ProcessCommandLine has_any ("download", "Invoke-Expression", "hidden", "delete shadows", "bcedit")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| sort by Timestamp desc

Vulnerability Identifiers & Advisory References

Compromised Asset Patterns