Loading story…
Authorities said Russia’s SVR-linked APT29 exploited the critical JetBrains TeamCity authentication bypass CVE-2023-42793 to compromise internet-facing on-premises servers, gaining unauthenticated remote code execution and access to software build environments. A joint advisory from the FBI, NSA, Poland’s SKW, CERT Polska, and the UK NCSC said the group had targeted vulnerable TeamCity instances since September 2023, affecting a few dozen organizations across the United States, Europe, Asia, and Australia and compromising more than 100 devices. Investigators said the attackers stole source code and secrets, escalated privileges, moved laterally, deployed backdoors, evaded EDR and antivirus tools, and exfiltrated data.
The same Russia-linked group was also reported targeting German political parties in a separate campaign that used bogus invitation-themed lures to deliver WineLoader malware. The activity showed APT29 operating across both opportunistic exploitation of exposed enterprise infrastructure and more tailored espionage against political targets, combining credential and system compromise with malware deployment to establish persistence and collect sensitive information.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Reports published in March 2024 said APT29 targeted German political parties using bogus invitation-themed lures and WineLoader malware. The activity was attributed to Russian state-linked operators and represented a separate campaign from the TeamCity exploitation.
The FBI, NSA, Poland’s SKW, CERT Polska, and the UK NCSC issued a joint advisory detailing APT29’s exploitation of JetBrains TeamCity servers and associated post-compromise tradecraft. The advisory said victim selection was largely opportunistic and driven by exposure of unpatched internet-facing servers.
Russia-linked APT29, assessed as tied to the SVR, began exploiting vulnerable internet-facing on-premises JetBrains TeamCity servers in opportunistic attacks. The activity started in September 2023 and enabled unauthenticated access that could lead to remote code execution, theft of source code and secrets, and compromise of software build pipelines.
Following initial access to TeamCity servers, the actors were observed escalating privileges, moving laterally, deploying backdoors, evading security tools, and exfiltrating data. The campaign affected a few dozen companies across the United States, Europe, Asia, and Australia, with more than 100 compromised devices observed.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Poland’s **CERT.PL** and the **Military Counterintelligence Service** disclosed a phishing-based espionage campaign targeting diplomatic personnel and attributed it to **APT29**, also tracked as **Nobelium** and **Cozy Bear**. The operation used phishing lures to deliver multiple malware families, including **HALFRIG**, **QUARTERRIG**, and **SNOWYAMBER**, with **ENVYSCOUT** commonly serving as the delivery script before follow-on activity involving **Cobalt Strike** or **Brute Ratel**. SecurityScorecard’s STRIKE Team reviewed related indicators and network traffic tied to the campaign but said the infrastructure evidence was not conclusive because the same hosting IPs also supported unrelated domains and much of the observed traffic traversed large hosting providers. Even so, some transfer patterns involving IP space in the **United States, United Kingdom, and Germany** were assessed as potentially consistent with diplomatic targeting aligned with Russian intelligence interests.
Aug 21, 2026
Mandiant reported that **APT29** conducted phishing campaigns that leveraged **Atlassian Trello** and cloud-hosted infrastructure to support credential theft and follow-on intrusion activity. The operation used legitimate online services to blend malicious traffic with normal business activity, a tactic that can complicate detection and attribution while helping the threat actor stage phishing lures and redirect victims through trusted platforms. The reporting links the activity to the Russia-aligned espionage group commonly tracked as **APT29**, which is known for stealthy, intelligence-focused operations against government and other high-value targets. The campaign highlights continued abuse of widely used SaaS and cloud services as part of state-backed phishing tradecraft, reinforcing the need for defenders to monitor suspicious authentication flows, investigate links delivered through trusted collaboration platforms, and harden identity protections against credential-harvesting attempts.
Jul 12, 2026
Amazon and Microsoft disclosed a large spear-phishing campaign by **APT29**/**Midnight Blizzard**, the Russian state-linked espionage group tied to the **SVR**, that used signed malicious **`.rdp`** files to trick targets into launching outbound Remote Desktop connections to attacker-controlled servers. The operation, tracked by CERT-UA as **`UAC-0215`**, relied on emails sent from previously compromised legitimate accounts and lures themed around **Amazon Web Services**, **Microsoft**, and **Zero Trust** integration issues. Amazon said the attackers used lookalike AWS-related domains, which it moved to seize, but the campaign was aimed at stealing victims' **Windows credentials** and collecting data rather than compromising Amazon or AWS customer accounts directly. Microsoft said the campaign targeted **thousands of recipients across dozens of countries**, including Ukraine, the UK, Europe, Australia, and Japan, with victims spanning government, academia, defense, and NGOs. CERT-UA warned that opening the rogue RDP attachments could expose local disks, network shares, printers, COM ports, audio devices, clipboard contents, and credentials to the attackers, while also enabling unauthorized program or script execution for follow-on activity. Defenders were urged to block **`.rdp`** files at email gateways, monitor and restrict outbound RDP connections from **`mstsc.exe`**, and apply the indicators and mitigations published by Microsoft and CERT-UA.
Jun 29, 2026