Last Updated On
Attackers Breach Build Servers Then Call Your Executives Demanding Payment
CISA has confirmed active exploitation of the critical unauthenticated remote code execution flaw CVE-2026-63077 in JetBrains TeamCity On Premises by adding it to the Known Exploited Vulnerabilities Catalog with an 8 August remediation deadline. At the same moment INC Ransomware is weaponizing SonicWall SMA zero days for initial access and then calling victims directly while a hard coded credential issue in Cisco Secure Firewall Management Center also sits on the KEV list.
Hotel and conference Wi Fi networks remain under active CaptiveCrunch compromise that steals Microsoft 365 tokens with actor attribution still unresolved between Storm 2945 and APT28. No public indicators of compromise exist for any of these campaigns.
Organizations running self hosted TeamCity SonicWall SMA or Cisco FMC must treat patching and exposure reduction as immediate operational priorities while hunting for anomalous process activity token reuse and unauthorized configuration changes.
9.8
CVSS Score
0
IOC Count
6
Source Count
0
Confidence Score
CVE 2026 63077, CVE 2026 20316, CVE 2026 15410
INC Ransomware, Storm 2945, APT28 Under Attribution, Unattributed
Technology, Financial Services, SaaS, DevOps, Healthcare, Energy, Retail, Professional Services, Legal, Water Utilities
Global, United States, India, Saudi Arabia, Australia, UAE, Colombia, Switzerland
Chapter 01 - Executive Overview
CISA confirmed active in the wild exploitation of the critical unauthenticated remote code execution flaw CVE-2026-63077 in JetBrains TeamCity On Premises by adding it to the Known Exploited Vulnerabilities Catalog on 5 August 2026 with a federal remediation deadline of 8 August 2026.
Any network reachable attacker can achieve full remote code execution through a deserialization weakness in the agent polling protocol without credentials or user interaction.
A compromised TeamCity instance enables build pipeline poisoning source code and secrets exfiltration and downstream software supply chain pivots.
Concurrently INC Ransomware is actively exploiting SonicWall SMA 1000 zero days CVE-2026-15409 and CVE-2026-15410 for initial access then applying aggressive phone call and email extortion pressure. CISA also listed the critical hard coded credential vulnerability CVE-2026-20316 in Cisco Secure Firewall Management Center requiring immediate patching under BOD mandates.
Separately the CaptiveCrunch campaign continues hijacking hotel and conference captive portals to deploy malware and harvest Microsoft 365 tokens with attribution still contested between Storm 2945 and APT28. No public indicators of compromise or confirmed attacker identity exist for the TeamCity case while the broader wave demonstrates concentrated attacker focus on internet facing enterprise management DevOps and remote access infrastructure this cycle.
Chapter 02 - Threat & Exposure Analysis
TeamCity Agent Polling Deserialization Under Active Attack
JetBrains disclosed CVE-2026-63077 on 27 July 2026 as an authentication bypass to remote code execution chain in the agent polling protocol affecting all TeamCity On Premises versions prior to 2026.1.3 and 2025.11.7.
The vulnerability class CWE 502 deserialization of untrusted data mirrors prior high profile TeamCity remote code execution flaws weaponized rapidly by both ransomware groups and state sponsored actors.
Nine days after disclosure CISA confirmed active exploitation via KEV listing reflecting the compressed disclosure to exploitation cadence observed across recent KEV additions.
TeamCity install base concentrates in mid to large engineering organizations running self hosted build infrastructure creating supply chain adjacent risk rather than narrow point product exposure.
INC Ransomware Extortion and SonicWall Activity
INC Ransomware functions as or partners with Initial Access Brokers to exploit SonicWall SMA 1000 zero days CVE-2026-15409 and CVE-2026-15410.
Operations accelerated from early August with aggressive pressure tactics including direct phone calls and emails to victims during extortion phases.
Cisco FMC and Concurrent KEV Wave
CISA flagged the hard coded credential issue CVE-2026-20316 in Cisco Secure Firewall Management Center alongside separate but concurrent listings for IBM Langflow N able N central and Apache Tomcat between 3 and 5 August 2026.
These remain distinct product vulnerabilities yet signal concentrated attacker interest in internet facing enterprise management and DevOps tooling.
CaptiveCrunch Wi Fi Hijacking
Threat actors compromise hotel and conference captive portals to distribute CornFlake and ChocoShell malware that harvests Microsoft 365 and Azure AD authentication tokens.
Attribution remains conflicting between Storm 2945 assessed as an SVR sub cluster and APT28.
Chapter 03 - Operational Response
Patch TeamCity On Premises immediately to 2026.1.3 or 2025.11.7 or apply the JetBrains security patch plugin supported for versions 2017.1 and later before the 8 August 2026 federal deadline.
If patching cannot complete at once remove TeamCity server and agent endpoints from direct internet exposure and restrict access via VPN or allow listed addresses.
Apply emergency patches for SonicWall SMA 1000 appliances addressing CVE-2026-15409 and CVE-2026-15410.
Update Cisco Secure FMC systems immediately to eliminate the hard coded credential risk under the applicable BOD mandate.
Hunt retroactively in TeamCity server and agent logs from 27 July 2026 forward for anomalous agent polling requests unexpected process spawns from the TeamCity service account and unauthorized new build configurations or artifact publishers.
Rotate all secrets tokens and signing keys accessible to any affected TeamCity instance if compromise cannot be ruled out.
Implement stringent conditional access policies that block Microsoft 365 token reuse outside trusted device boundaries especially for users authenticating from public or hotel networks.
Integrate out of band communication verification into incident response plans because of INC Ransomware phone call pressure tactics.
Monitor consulted sources for forthcoming indicator or attribution updates none of which exist as of this report.
10 July 2026 private report of the TeamCity vulnerability to JetBrains.
27 July 2026 JetBrains publishes the security bulletin for CVE-2026-63077 and releases patched versions.
29 July 2026 CISA adds Cisco FMC CVE-2026-20316 to the KEV catalog.
30 July 2026 independent coverage of the TeamCity disclosure appears.
1 August 2026 CISA BOD compliance window for Cisco FMC begins.
1 May 2026 onward CaptiveCrunch hotel portal activity observed.
3 to 5 August 2026 CISA adds Langflow N able N central and Apache Tomcat entries in the same cycle.
4 August 2026 public intelligence confirms INC Ransomware exploitation of SonicWall zero days in active extortion campaigns.
5 August 2026 CISA adds CVE-2026-63077 to the KEV catalog confirming active exploitation with remediation deadline of 8 August 2026.
6 August 2026 multiple secondary outlets publish exploitation confirmed follow up coverage. This report compiled 6 August 2026 at 22 45 IST.
Chapter 04 - Detection Intelligence
CVE-2026-63077 is a deserialization of untrusted data flaw CWE 502 in TeamCity agent polling protocol.
The server deserializes attacker supplied objects from a network reachable endpoint without validating type or origin.
An attacker constructs a gadget chain that executes arbitrary code during deserialization.
No authentication token or session is required because the flaw resides in the pre authentication agent registration or polling handshake.
Successful exploitation grants code execution under the TeamCity server or build agent service account typically a highly privileged account with access to source repositories artifact repositories and secret stores.
Exact request structure endpoint serialized payload and exploit artefacts remain undisclosed in consulted sources.
Cisco FMC Hard Coded Credential CVE-2026-20316
Allows unauthenticated remote attackers to access a built in low privileged account on the FMC interface.
Enables retrieval of sensitive configuration data that can support further lateral movement.
SonicWall SMA 1000 Flaws CVE-2026-15409 and CVE-2026-15410
Enable threat actors to bypass authentication and execute code granting deep initial access later monetized by Initial Access Brokers or ransomware operators.
CaptiveCrunch
Compromises captive portals to deliver malware that performs device code phishing against Microsoft identity endpoints harvesting refresh and access tokens.
No indicators of compromise IP addresses domains URLs file hashes or YARA matchable samples have been published for CVE-2026-63077.
Consulted sources likewise release no specific IP addresses hashes or domains for the SonicWall SMA zero days Cisco FMC hard coded credential abuse or CaptiveCrunch malware deployment.
Do not block speculative values.
Hunt using behavior exposure inventory authentication anomalies process execution and configuration changes.
This field will require follow up once government catalogs vendors or major threat intelligence teams release telemetry.
Hunting hypotheses derived from vulnerability classes and prior incident patterns. None validated against confirmed exploitation samples because none have been publicly released. Tune to local environments before deployment and treat all hits as investigative leads.
SIGMA style pseudocode anomalous process spawn from TeamCity service
SIGMA style pseudocode new or modified web resource in TeamCity webapps directory
SIEM field logic anomalous agent polling traffic
YARA pattern generic Java deserialization gadget indicator
SIGMA rule potential Cisco FMC built in account usage
YARA pattern CaptiveCrunch CornFlake indicator
T1190 Exploit Public Facing Application source mapped for TeamCity SonicWall and Cisco
T1059 Command and Scripting Interpreter inferred from deserialization execution patterns
T1505.003 Server Software Component Web Shell inferred from CI CD post compromise precedent
T1071 Application Layer Protocol inferred post RCE command and control
T1078.001 Valid Accounts Default Accounts for Cisco FMC built in account
T1528 Steal Application Access Token for CaptiveCrunch Microsoft 365 harvesting
T1444 Captive Portal Bypass for hotel Wi Fi activity
T1657 Extortion for INC Ransomware pressure tactics
Inferred D3FEND countermeasures
D3 PA Process Analysis for anomalous child process detection
D3 FCR File Content Rules for webapps directory integrity monitoring
D3 NTA Network Traffic Analysis for agent polling endpoint anomaly detection
Chapter 05 - Governance, Risk & Compliance
Federal Civilian Executive Branch agencies are bound by applicable BOD directives to remediate TeamCity by 8 August 2026 and Cisco FMC under the earlier mandate.
Private sector organizations should treat the same deadlines as internal SLAs given confirmed active exploitation and critical severity.
Organizations subject to SOC 2 ISO 27001 or software supply chain attestation requirements such as SLSA or NIST SSDF should document any unpatched exposure in their vulnerability management exception register because TeamCity functions as a build integrity control point.
Travel security policies must explicitly address Microsoft 365 token theft risks over hotel Wi Fi networks.
Incident response plans require out of band communication verification channels because of INC Ransomware phone call and email pressure tactics.
Treat internet facing TeamCity SonicWall SMA and Cisco FMC instances as Tier 0 assets. Record owner version internet exposure privileged service account scope connected source control systems build secret stores artifact repositories and build agent trust relationships. Require remediation evidence exposure review results and post patch checks for unauthorized configuration token plugin or artifact changes.
No sector specific regulatory advisory has been issued for these CVEs as of this report.
Chapter 06 - Adversary Emulation
Validate detection coverage for unauthenticated POST traffic to TeamCity agent polling or RPC endpoints carrying serialized object payloads.
Validate detection of anomalous child processes spawned by the TeamCity server or build agent service account.
Validate detection of unauthorized file writes into the TeamCity webapps directory.
Because no public proof of concept or exploit sample exists emulation must rely on synthetic simulation such as crafting a benign deserialization payload against a lab TeamCity instance rather than adversary sample replay.
Execute a simulated device code phishing attack over a controlled captive portal to test Azure AD token theft detection.
Emulate INC Ransomware pressure tactics by initiating a simulated extortion call or email to the SOC tier 1 triage desk to evaluate escalation procedures.
In an isolated non production TeamCity environment confirm vulnerable version inventory detection test firewall policy blocks from untrusted networks generate an approved TeamCity build step that launches a benign interpreter command and verify EDR or SIEM captures parent child process lineage.
Recommend a purple team exercise validating log retention and alert fidelity for the detection logic before operational reliance.
Do not emulate unauthenticated exploitation against production systems.
Factor | Contribution | Notes |
|---|---|---|
KEV confirmation of active exploitation | +40 | Definitive for TeamCity SonicWall related and Cisco cases |
Technical metadata and CVSS consistency | +15 | NVD and vendor alignment on scope and impact |
Multi source corroboration | +12 | Independent outlets confirm timelines and tactics without contradiction |
Vendor primary disclosure consistency | +8 | JetBrains SonicWall and Cisco advisories align |
Zero published IOCs | -15 | Major gap for actionable blocking and hunting precision |
Attribution gaps and conflicts | -10 | TeamCity unattributed CaptiveCrunch contested |
Partial TTP inference | -7 | Only core initial access techniques are source mapped remainder behavioral |
Combined score | 78 | Well evidenced exploitation confirmed record with intelligence gaps on actor identity exact exploit mechanics and indicators |