{"id":55651,"date":"2024-03-21T14:13:15","date_gmt":"2024-03-21T14:13:15","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/35684\/Ransomware-RATs-And-More-Deployed-On-Compromised-TeamCity-Servers.html"},"modified":"2024-03-21T14:13:15","modified_gmt":"2024-03-21T14:13:15","slug":"ransomware-rats-and-more-deployed-on-compromised-teamcity-servers","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\/","title":{"rendered":"Ransomware, RATs, And More Deployed On Compromised TeamCity Servers"},"content":{"rendered":"
<\/div>\n

A JetBrains TeamCity authentication bypass vulnerability is being leveraged to deploy open-source ransomware, remote access tools (RATs), cryptominers and Cobalt Strike beacons, according to Trend Micro research published Tuesday<\/a>.<\/p>\n

Jasmin ransomware, SparkRAT backdoors and XMRig cryptocurrency miners were among the post-exploitation payloads observed by Trend Micro, with the first signs of active exploitation appearing one day after the vulnerability was disclosed, Trend Micro researchers told SC Media.<\/p>\n

\u201cWe\u2019ve seen multiple malicious actors using them in their attacks, which shows that once new vulnerabilities are disclosed, and public proof-of-concept codes are published, we regularly start seeing many attacks by many adversaries taking advantage of these quickly,\u201d said Trend Micro Vice President of Threat Intelligence Jon Clay.<\/p>\n

The critical vulnerability<\/a>, tracked as CVE-2024-27198<\/a>, along with a high-severity directory traversal flaw tracked as CVE-2024-27199<\/a>, were fixed and disclosed by JetBrains<\/a> on March 4.<\/p>\n

The most severe vulnerability enables an unauthenticated attacker to create an administrator account and achieve remote code execution on on-premises instances of the TeamCity continuous integration and continuous development (CI\/CD) platform.<\/p>\n

Rapid7, which discovered the bugs, published its analysis<\/a> of the flaws on the same day as JetBrains\u2019 disclosure, following disagreement between the companies<\/a> about the disclosure timeline. A proof-of-concept (PoC) exploit module was published by Rapid7 on GitHub<\/a> a day later.<\/p>\n

TeamCity attackers commandeer legitimate open-source software<\/h2>\n

The payloads identified by Trend Micro all involve the hijacking of legitimate software tools by cybercriminals, with the likely goal of financial gain. Jasmin, SparkRAT and XMRig are all open-source tools available on GitHub.<\/p>\n

\u201cMany adversaries will utilize open-source tools in their attacks, so this isn\u2019t unique to many of the attacks we see. Attackers want to maximize their profit and as such, developing their own tools costs them, so using open-source tools allows them both the ability to access tools easily, but also helps them profit more from their attacks,\u201d Clay said.<\/p>\n

The Jasmin ransomware is described by its creator Siddhant Gour as a \u201cWannaCry clone\u201d and is designed as a red teaming tool for simulating ransomware attacks, with both the encryptor and decryptor available.<\/p>\n

The malicious variant described by Trend Micro encrypts victims\u2019 files and adds the extension \u201c.lsoc.\u201d The .html ransom note file left by the threat actors was found to have its source code obfuscated, with the text of the note generated from a JavaScript process, likely to avoid detection.  <\/p>\n

\u201cOften threat actors will use pieces and components from open-source malware as building blocks for new strains of the malware or new malware families,\u201d noted Peter Girnus, senior threat researcher at Trend Micro\u2019s Zero Day Initiative, in an email to SC Media. \u201cSimilar to viruses, often the best \u2018genetic\u2019 or \u2018code\u2019 attributes are repurposed for new campaigns.\u201d<\/p>\n

Threat actors deploying the SparkRAT backdoor and XMRig cryptominer on TeamCity instances were also seen using living-off-the-land binary (LOLBin) tools to avoid detection.<\/p>\n

In the case of SparkRAT, a PowerShell command was used to download and execute a batch file called \u201cwin.bat,\u201d which then uses the Windows certificate management tool certutil.exe to download and execute the SparkRAT before deleting the original batch file.<\/p>\n

A similar method of batch file and certutil use was observed in the deployment of XMRig. The three components of the cryptominer \u2014 JavaAccessBridge-64.exe, config.json and WinRing0x64.sys \u2014 were dropped in the public videos directory of the target system.   <\/p>\n

Additionally, threat actors also deployed Cobalt Strike beacons on vulnerable servers. Cobalt Strike, a legitimate penetration testing tool that has long been misused by ransomware groups<\/a> and other cybercriminals, can be used to establish persistence on the server and facilitate command and control (C2) communications.<\/p>\n

Due to its role as a CI\/CD platform used by many software developers, exploitation of TeamCity vulnerabilities puts valuable source code, software builds and artifacts at risk. And TeamCity servers an attractive target for threat actors, as noted by the FBI, CISA, NSA and other international authorities in a joint advisory about the Russia-backed threat actor CozyBear\u2019s exploitation of a different critical TeamCity vulnerability last year<\/a>.<\/p>\n

More than 1,400 TeamCity servers compromised, 600 still unpatched<\/h2>\n

As noted by Trend Micro, exploitation of CVE-2024-27198 began shortly after its disclosure. More than 1,400 TeamCity servers<\/a> were found to be compromised less than a week after the patch became available, according to LeakIX, which reported that attackers were creating between three and 300 rogue admin accounts per server.  <\/p>\n

CVE-2024-27198 has also been used by the ransomware gang BianLian<\/a>, as reported by GuidePoint Security researchers last week. BianLian used living-off-the-land tactics to deploy a novel backdoor, and also targeted TeamCity CVE-2023-42693<\/a>, which was patched last September.<\/p>\n

More than 600 TeamCity instances vulnerable to CVE-2024-27198<\/a> were detected by the security organization Shadowserver as of Tuesday, down from more than 1,500 detected on March 5. Users of on-premises version of TeamCity must upgrade to version 2023.11.4 to prevent exploitation.<\/p>\n

TeamCity Solutions Engineer Daniel Gallo authored a blog post<\/a> last Thursday outlining steps users can take if they suspect their server has been compromised.<\/p>\n

Gallo also wrote a blog last Monday<\/a> describing cases of customers falling victim to ransomware and other attacks despite attempting to patch. The post explains the thought process behind JetBrain\u2019s coordinated disclosure policy and reiterates earlier criticism of Rapid7\u2019s decision to publish a PoC exploit shortly after the patch.<\/p>\n

READ MORE HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

READ MORE HERE…<\/p>\n","protected":false},"author":2,"featured_media":55652,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[277],"tags":[10886],"class_list":["post-55651","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-blogs","tag-headlinehackermalwaretrojanflawbackdoorcryptography"],"yoast_head":"\nRansomware, RATs, And More Deployed On Compromised TeamCity Servers 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ransomware, RATs, And More Deployed On Compromised TeamCity Servers 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2024-03-21T14:13:15+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/files.scmagazine.com\/wp-content\/uploads\/2024\/03\/AdobeStock_124782093-1.jpg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Ransomware, RATs, And More Deployed On Compromised TeamCity Servers\",\"datePublished\":\"2024-03-21T14:13:15+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\\\/\"},\"wordCount\":897,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/03\\\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers.jpg\",\"keywords\":[\"headline,hacker,malware,trojan,flaw,backdoor,cryptography\"],\"articleSection\":[\"CyberSecurity Blogs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\\\/\",\"name\":\"Ransomware, RATs, And More Deployed On Compromised TeamCity Servers 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/03\\\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers.jpg\",\"datePublished\":\"2024-03-21T14:13:15+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/03\\\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/03\\\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers.jpg\",\"width\":800,\"height\":461},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"headline,hacker,malware,trojan,flaw,backdoor,cryptography\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/headlinehackermalwaretrojanflawbackdoorcryptography\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Ransomware, RATs, And More Deployed On Compromised TeamCity Servers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Ransomware, RATs, And More Deployed On Compromised TeamCity Servers 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\/","og_locale":"en_US","og_type":"article","og_title":"Ransomware, RATs, And More Deployed On Compromised TeamCity Servers 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2024-03-21T14:13:15+00:00","og_image":[{"url":"https:\/\/files.scmagazine.com\/wp-content\/uploads\/2024\/03\/AdobeStock_124782093-1.jpg","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Ransomware, RATs, And More Deployed On Compromised TeamCity Servers","datePublished":"2024-03-21T14:13:15+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\/"},"wordCount":897,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2024\/03\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers.jpg","keywords":["headline,hacker,malware,trojan,flaw,backdoor,cryptography"],"articleSection":["CyberSecurity Blogs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\/","url":"https:\/\/www.threatshub.org\/blog\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\/","name":"Ransomware, RATs, And More Deployed On Compromised TeamCity Servers 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2024\/03\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers.jpg","datePublished":"2024-03-21T14:13:15+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2024\/03\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2024\/03\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers.jpg","width":800,"height":461},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-rats-and-more-deployed-on-compromised-teamcity-servers\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"headline,hacker,malware,trojan,flaw,backdoor,cryptography","item":"https:\/\/www.threatshub.org\/blog\/tag\/headlinehackermalwaretrojanflawbackdoorcryptography\/"},{"@type":"ListItem","position":3,"name":"Ransomware, RATs, And More Deployed On Compromised TeamCity Servers"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/55651","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=55651"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/55651\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/55652"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=55651"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=55651"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=55651"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}