Alpha Team Flash Report: JetBrains Implicated in SolarWinds Breach

On 6 January 2021, The New York Times reported that JetBrains, a software company that builds tools for developers and project managers, was allegedly used to gain access to the SolarWinds supply chain. According to the report, private companies and US intelligence agencies are investigating whether JetBrains was breached and used as a stepping stone into the SolarWinds build environment. JetBrains’ product, TeamCity, which is a Continuous Integration/Continuous Deployment (CI/CD) server, was apparently the target of the actors who breached SolarWinds.

The article contained no tactics, techniques, and procedures (TTPs) or indicators of compromise (IOCs) that described the attack in detail. Furthermore, the CEO of JetBrains has since indicated the company is unaware of any ongoing investigations but expressed his intention to cooperate if such investigations were to be undertaken. ZeroFOX Alpha Team assesses that, due to the lack of clarity in The New York Times report on the details of the JetBrains compromise and the lack of any additional IOCs, more details need to be publicized to implicate the company as having had a role in the larger SolarWinds hack.

Recommendations

If applicable, update TeamCity servers to the latest version
Perform continuous monitoring of news related to this breach for associated IOCs and TTPs. The CISA Alert website has up to date information on the SolarWinds breach https://us-cert.cisa.gov/ncas/alerts/aa20-352a, as well as tools and IOCs

Details

After the article by The New York Times was published, JetBrains CEO Maxim Shafirov posted a response on the company’s website denying the allegations. The CEO confirmed that SolarWinds is a customer of JetBrains and that “...JetBrains has not taken part or been involved in this attack in any way.” He also stated that neither SolarWinds nor law enforcement has contacted his company to discuss the attack or to coordinate disclosures in any way but expressed that, if such an investigation were to be undertaken, JetBrains would cooperate.

Open-source research on the compromise did not return any reliable IOCs or TTPs related to the attack. According to The New York Times, by “..compromising TeamCity, or exploiting gaps in how customers use the tool, cybersecurity experts say the Russian hackers could have inconspicuously planted back doors in an untold number of JetBrains’ clients.” This can be interpreted as either JetBrains itself was compromised, which then resulted in a supply chain infection that made its way into SolarWinds, or JetBrains’ TeamCity was used as a vector for entry into SolarWinds itself. Alpha Team assesses that, although The New York Times is a reliable source, without further details, there is no way to tell from the article which route was taken by the actors behind SolarWinds.

A HackerNews post is circulating in which a supposed employee of JetBrains speculated that the breach was the result of an on-premises installation of TeamCity. This comment aligns with The New York Times statement about TeamCity being compromised at SolarWinds; although the HackerNews account is aged and comments frequently, the reliability of the information is low.

ZeroFOX Intelligence has a total of 40 TeamCity vulnerabilities listed. Of these vulnerabilities, three are listed as critical: CVE-2019-18364, CVE-2019-15039, and CVE-2019-12157.

As of 7 January 2021, CVE-2019-15039 has one publicly listed exploit, while the others do not. Given that multiple US intelligence agencies attributed the SolarWinds breach to a nation-state, exploiting an exposed TeamCity server should be trivial for this actor group.