{"uuid": "94a2e575-4cef-4d70-ba4f-78161c1627a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-42793", "type": "exploited", "source": "https://t.me/hacking_Attack/123386", "content": "Black Hat Ethical Hacking\nMicrosoft Warns of North Korean Hacking Groups Exploiting TeamCity Vulnerability\n\nMicrosoft Warns of North Korean Hacking Groups Exploiting TeamCity Vulnerability\nPost Views: 32 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nMicrosoft\u2019s Threat Intelligence Team has detected concerning activity involving North Korean hacking groups exploiting a critical security flaw in TeamCity servers. This vulnerability, identified as CVE-2023-42793, allows unauthenticated attackers to remotely execute code.\n\nTeamCity serves as a continuous integration and deployment server, integral to software development infrastructure. The CVE-2023-42793 vulnerability, rated 9.8/10 in severity, was promptly addressed by TeamCity. However, it appears that malicious actors have been quick to exploit this weakness, thereby breaching corporate networks.\n\nThe specific intent behind these attacks remains undisclosed, but Microsoft has expressed concerns about the potential for software supply chain attacks. In past operations, North Korean threat actors, including Diamond Sleet and ZINC, have successfully conducted software supply chain attacks by infiltrating build environments.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nThe attack vectors in these operations involve the deployment of backdoors and the establishment of persistence on the compromised network. Lazarus, for instance, has been witnessed deploying the ForestTiger malware, which serves as a backdoor for executing commands on the compromised server.\n\nhttps://www.bleepstatic.com/images/news/security/lazarus-attack-chain-1.jpg A Lazarus attack chain was seen after exploiting the TeamCity flaw\nSource: Microsoft\n\nAnother attack chain involves DLL search order hijacking attacks, leading to the deployment of a remote access Trojan (RAT) via a malware loader called FeedLoad.\n\nAndariel, a subgroup of Lazarus, adopts a more hands-on approach. They create an \u2018krtbgt\u2019 admin account on the compromised server and run commands to collect system information. Ultimately, a payload is deployed, installing the HazyLoad proxy tool, ensuring a persistent connection between the compromised server and Andariel\u2019s infrastructure.\n\nhttps://www.bleepstatic.com/images/news/security/andariel-attack-chain.jpg Andariel attack chain seen in breaches\nSource: Microsoft\n\nThe common thread across these attack chains is the exfiltration of credentials from LSASS, which is likely used to propagate laterally within the compromised network. Microsoft shared more details of the attack chain along with indicators of compromise in this article.\nTrending: Post-Exploitation Techniques: Maintaining Access, Escalating Privileges, Gathering Credentials, Covering Tracks Trending: Recon Tool: fetchmeurls\nBoth Lazarus and Andariel are state-sponsored North Korean hacking groups. While their activities benefit the North Korean government, their objectives can vary.\n\nLazarus has been involved in espionage, data theft, and financial gain activities, whereas Andariel primarily targets defense and IT service entities, engaging in cyber espionage, data theft, destructive attacks, and even ransomware campaigns.\nTrending: Gaza-Based Cyber Threat Actor \u2018Storm-1133\u2019 Strikes Israeli Energy and Defense Sectors, Microsoft Reveals Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@[...]", "creation_timestamp": "2026-09-04T02:00:04.642372Z"}