The company confirmed that the threat actors leveraged the unpatched TeamCity flaw to infiltrate internal systems, ultimately extracting AWS credentials. While JetBrains has not specified the exact scope of the compromise, the advisory stresses that any credentials used for Cadence executions should be treated as potentially exposed.

Affected users are advised to take the following actions:

• Revoke and rotate all credentials and secrets associated with Cadence executions immediately.
• Audit recent activity logs for any unauthorized access or unusual API calls linked to AWS resources.
• Review TeamCity server configurations for signs of tampering or backdoor accounts.

Cadence is JetBrains' managed service for running background jobs and scheduled tasks, often used in CI/CD pipelines. The incident highlights the cascading risk of unpatched infrastructure tools, as a single overlooked update can expose downstream cloud services.

Source: The Hacker News

Has your organization audited its TeamCity and CI/CD credential stores since this disclosure, and what steps are you taking to verify no third-party access paths remain?