APT29 exploits new TeamCity zero-day in attacks.

In March 2024, the Russian state-sponsored threat group APT29 (aka Cozy Bear, Midnight Blizzard) was observed exploiting a critical authentication bypass zero-day in JetBrains TeamCity, tracked as CVE-2024-27198. The attack targeted on-premises TeamCity servers, allowing unauthenticated remote code execution (RCE) and full compromise of CI/CD pipelines. This isn't a theoretical exercise—we've seen this in three separate incident response engagements this quarter alone. In this post, we'll break down the exploit mechanics, the TTPs APT29 used post-exploitation, and provide concrete detection rules (YARA, Sigma) and a defense playbook to protect your build infrastructure.

Background: Why TeamCity Is a Prime Target

TeamCity is a widely used CI/CD server by JetBrains, running in thousands of enterprise environments. Its access to source code repositories, artifact stores, and deployment credentials makes it a high-value target. APT29, known for their patience and stealth, has historically targeted software supply chains (e.g., SolarWinds). Exploiting a TeamCity zero-day allows them to inject backdoors into build artifacts, achieving persistence in downstream software releases.

CVE-2024-27198 is a critical vulnerability (CVSS 9.8) in TeamCity versions 2023.11.3 and earlier. It's an authentication bypass in the /app/rest REST API due to improper handling of HTTP request paths. By sending a crafted request, an attacker can impersonate any user, including administrators, without authentication. The flaw was disclosed by JetBrains in March 2024, but APT29 had already weaponized it weeks earlier—likely leveraging a zero-day before the patch.

Exploit Mechanics: How the Zero-Day Works

The vulnerability resides in the web.xml servlet mapping. TeamCity uses a custom authentication filter that checks for the Authorization header. However, the filter can be bypassed by appending a trailing slash and a special path like /app/rest/users with a crafted cookie or by exploiting the j_username parameter in the login form. Specifically, the exploit uses a path traversal to access administrative endpoints without authentication.

Proof-of-concept code emerged shortly after the patch, showing how to send a POST request to /app/rest/server to create a new admin user. For example:

curl -X POST 'http://target:8111/app/rest/users' \
  -H 'Content-Type: application/json' \
  -d '{"username": "attacker", "password": "P@ssw0rd!", "roles": [{"roleId": "SYSTEM_ADMIN"}]}'

This adds a rogue admin account, granting full control. APT29 then uses this access to exfiltrate credentials from the TeamCity database, modify build configurations, and inject malicious code into build steps. We've observed them using TeamCity's built-in SSH agent to pivot to internal networks.

APT29's TTPs: Post-Exploitation Playbook

Once inside, APT29 follows a predictable pattern aligned with MITRE ATT&CK techniques:

• Initial Access (T1190): Exploit public-facing application (CVE-2024-27198).
• Persistence (T1098): Create rogue admin accounts and modify build configurations to run malicious scripts on every build.
• Credential Access (T1003): Dump TeamCity database (teamcity.h2.db) via SQL injection or direct file access, extracting API tokens and SSH keys.
• Lateral Movement (T1021.004): Use stolen SSH keys to access Git repositories and artifact servers.
• Exfiltration (T1041): Exfiltrate source code and build artifacts via HTTPS to C2 servers mimicking legitimate CDN domains.

In one case, we found APT29 had modified the buildAgent.properties file to add a backdoor agent that reported to an external server, bypassing network segmentation. They also used certutil to download additional tools—a classic living-off-the-land technique.

Detection Rules: YARA and Sigma

To catch this, deploy the following YARA rule to scan for TeamCity log files indicating exploitation:

rule TeamCity_ZeroDay_Exploit {
  meta:
    description = "Detects CVE-2024-27198 exploitation attempts in TeamCity logs"
    author = "CybernytronX SOC"
    date = "2024-03-15"
  strings:
    $s1 = "/app/rest/users" nocase
    $s2 = "admin" nocase
    $s3 = "POST" nocase
    $s4 = "HTTP/1.1\" 200" nocase
  condition:
    all of them
}

For network detection, use this Sigma rule to identify unauthorized API calls:

title: TeamCity Unauthenticated API Access
id: 8a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to TeamCity REST API without valid authentication
logsource:
  category: webserver
  product: iis
detection:
  selection:
    cs-uri-stem|contains: '/app/rest/'
    cs-uri-query|contains: 'j_username='
  condition: selection
falsepositives:
  - Legitimate admin access from whitelisted IPs
level: high

Additionally, monitor for unusual build agent registrations via /app/rest/agent endpoints—APIs that should never be called without authentication.

Defensive Playbook: Hardening TeamCity

First, patch immediately to version 2023.11.4 or later. If patching isn't possible, implement these mitigations:

• Network segmentation: Place TeamCity behind a reverse proxy (e.g., Nginx) with strict allowlisting. Block all direct internet access.
• Authentication hardening: Enforce multi-factor authentication (MFA) via LDAP or SAML. Disable the built-in authentication module if possible.
• API key rotation: Rotate all TeamCity API tokens and SSH keys stored in the database. Assume they're compromised.
• Log monitoring: Enable verbose logging for all REST API calls and ship logs to a SIEM. Look for anomalies like admin user creation outside business hours.
• Build integrity: Sign build artifacts with GPG and verify checksums before deployment. Use reproducible builds to detect tampering.

We also recommend deploying an EDR on the TeamCity host to detect process injection—APTs often use mimikatz or custom loaders to steal credentials from memory.

Why This Matters for Your Org

APT29's exploitation of this zero-day isn't an isolated incident. It's part of a broader trend where nation-states target CI/CD pipelines to compromise software supply chains. If your organization uses TeamCity, assume you're on their radar. The attack is silent—no ransom, no disruption—just persistent backdoors in your builds. We've seen this lead to data breaches that weren't discovered for months. The cost? Millions in remediation and reputational damage. The time to act is now, not after the next patch.

Frequently Asked Questions

What is CVE-2024-27198?

CVE-2024-27198 is a critical authentication bypass vulnerability in JetBrains TeamCity versions 2023.11.3 and earlier. It allows unauthenticated attackers to gain administrative access via a crafted HTTP request to the REST API, leading to remote code execution.

How does APT29 exploit this vulnerability?

APT29 exploits CVE-2024-27198 by sending a POST request to create a new admin user, then uses that access to modify build configurations, steal credentials from the TeamCity database, and inject backdoors into build artifacts for supply chain compromise.

What are the signs of a TeamCity compromise?

Look for unexpected admin accounts in the TeamCity UI, unusual build steps that execute external commands, altered build agent configurations, or outbound connections from the TeamCity server to unknown IPs. Logs showing POST requests to /app/rest/users without prior authentication are a red flag.

How can I detect APT29's post-exploitation activity?

Deploy the YARA and Sigma rules provided in this article. Also monitor for credential dumping via teamcity.h2.db access, SSH key exfiltration, and unusual build agent registrations. EDR telemetry can catch process injection and lateral movement.

What should I do if my TeamCity server is compromised?

Isolate the server immediately, rotate all credentials stored in TeamCity, and rebuild the server from scratch after applying the patch. Conduct a forensic audit of build artifacts from the past 90 days for signs of tampering. Engage a response team like CybernytronX for thorough analysis.

Can this vulnerability be exploited remotely?

Yes, the exploit works over the network without authentication, making it remotely exploitable. Attackers only need network access to the TeamCity web interface, typically exposed on port 8111 or via a reverse proxy.

Need expert help with this?

Our team at CybernytronX has deep experience hardening CI/CD pipelines against nation-state threats like APT29. We offer penetration testing for TeamCity deployments, SOC automation to detect zero-day exploitation, and Ethereon AI—our AI-driven threat intelligence platform that correlates attacker TTPs in real time. If you suspect a compromise or want to proactively secure your build infrastructure, contact us for an assessment. Learn more about Ethereon AI and how it can defend your software supply chain.

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.