BianLian Threat Actors Exploiting JetBrains TeamCity Flaws in Ransomware Attacks

GuidePoint Security and other researchers observed BianLian ransomware actors exploiting critical TeamCity vulnerabilities (CVE-2024-27198 or CVE-2023-42793) to gain initial access, create accounts, and deploy a PowerShell implementation of their Go backdoor (BianDoor) for exfiltration-based extortion; the report highlights living-off-the-land techniques, use of remote access tools, and notes related active exploitation of Confluence CVE-2023-22527 by other ransomware families.