> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
- URL: https://f4n6.co.uk/security-feed/attackers-breached-jetbrains-cadence-via-unpatched-teamcity-extracting-aws-credentials/
- Published: 2026-09-05T23:57:35.000Z
- Updated: 2026-09-05T23:57:35.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

Unidentified threat actors exploited CVE-2026-63077 (CVSS 9.8, critical) — an unauthenticated deserialization-of-untrusted-data flaw in JetBrains TeamCity permitting arbitrary OS command execution with the privileges of the TeamCity server process — to breach JetBrains' own Cadence cloud service between 8 and 24 August 2026\. The actor accessed a full 2024 Cadence server backup containing user credentials, configuration, artifacts and logs, extracted multiple AWS IAM users and their associated credentials/secrets, and may have accessed S3 data and PyCharm-synchronised source code. The vulnerability is under active exploitation in the wild and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on 5 August 2026\. Any EMEA financial services client running TeamCity — including build infrastructure supporting regulated workloads — should treat unpatched instances as presumptively compromised, and any client that used JetBrains Cadence should assume its credentials, secrets and synchronised source code are exposed. Attribution is unconfirmed; no MITRE ATT&CK profile exists for the actor.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The incident occurred at a third-party vendor (JetBrains), but the trigger facts here — a vendor breach, credential rotation, and patching of a KEV-listed CVE — map to baseline incident-management and patching duties that apply to virtually any security incident and do not change what a client must do under a specific article. Clients with their own affected TeamCity instances or Cadence usage should assess their internal incident processes under their existing DORA Art. 17 (ICT-related incident management process) and NIS2 Art. 23 (incident reporting obligations) frameworks on their own facts.

## 3\. Technical analysis & attack chain

### Confirmed attack chain (per JetBrains' disclosure via The Hacker News)

1. **Initial access.** The threat actor exploited CVE-2026-63077 against a JetBrains-hosted Cadence server, "api.cadence.jetbrains.com". The flaw is a deserialization-of-untrusted-data vulnerability that allows an unauthenticated attacker with network access to a TeamCity server to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process. CVSS 9.8, critical; CISA KEV-listed 5 August 2026.
2. **Breach window.** The intrusion took place between 8 and 24 August 2026\. JetBrains discovered the exploitation on 23 August 2026\. The exploited server has been taken offline.
3. **Data access.** The actor accessed data contained in a full Cadence server backup dating from 2024, and obtained unauthorised access that could have allowed them to reach storage containing data associated with current Cadence users.
4. **Credential extraction.** Confirmed accessed/compromised material includes: - Personal data: usernames, real names, email addresses, last-login timestamps, last-accessed IP addresses. - The full 2024 Cadence server backup, containing credentials, configuration, artifacts, logs and other data. - Multiple AWS IAM users and associated credentials/secrets used with Cadence, extracted from the 2024 backup — including IAM users belonging to JetBrains employees who used the service. - Files stored in S3 buckets within JetBrains AWS accounts used by Cadence.
5. **Source-code exposure (possible).** Attackers may have accessed source code synchronised from PyCharm projects to the affected server — covering scenarios where users uploaded or synchronised project files from PyCharm for execution in Cadence, potentially exposing code, credentials or configurations.
6. **Vendor response.** JetBrains invalidated all access tokens used by the JetBrains Cadence plugin in PyCharm to connect to Cadence, and took the exploited server offline.

### Key defensive points

- **Component:** JetBrains TeamCity, exploited against a JetBrains-hosted Cadence environment. Cadence is a JetBrains-hosted cloud computing service integrating with PyCharm via an optional plugin, allowing developers to run ML and heavy workloads on cloud GPUs from the IDE.
- **Vulnerability mechanism:** unauthenticated deserialization of untrusted data → authentication bypass → arbitrary OS command execution as the TeamCity server process. This is a pre-auth RCE: no valid credentials or user interaction required, only network reachability of the TeamCity server.
- **Root cause at the vendor:** JetBrains conceded the affected Cadence server should have been patched as part of its own vulnerability response efforts but did not explain why it was not. This is a vendor-side patching failure, not a novel vulnerability variant.
- **Persistence / C2 / lateral movement:** not described in the source material. Do not assume beyond the confirmed access-and-extraction activity.
- **Impact:** credential and secret compromise (including AWS IAM credentials), source-code exposure, personal-data exposure. No ransomware or extortion indicators are present in the source material; characterise this as credential theft and data access, not ransomware.

**Confidence caveats:** All breach-detail claims (backup contents, AWS IAM extraction, S3 access, PyCharm source-code exposure) are single-sourced — JetBrains' own disclosure as reported by The Hacker News on 5 September 2026\. The active in-the-wild exploitation of CVE-2026-63077 is corroborated by CISA KEV listing (5 August 2026) and SecurityWeek reporting. Attribution is unconfirmed: "It's not clear who is behind the activity." No MITRE ATT&CK profile exists for the actor in our verified reference data; treat any attribution claims as unconfirmed.

## 4\. Mitigation & containment

### P1 — within 24 hours (Cadence users)

1. **Revoke and rotate all credentials and secrets** that may have been used to run Cadence executions — per JetBrains: "any credentials or secrets stored in Cadence, contained in the compromised backup, or made available to executions on the affected server should be considered compromised and must be revoked or rotated." Priority order: AWS IAM keys and secrets, then CI/CD tokens, then any repository or registry credentials exposed to executions.
2. **Treat all Cadence executions, including inputs and outputs, as potentially untrusted.** Review any code or artifacts produced by Cadence executions in the breach window (8–24 August 2026) for tampering before promoting to production.
3. **Audit AWS accounts** for IAM users whose credentials were used with Cadence: check CloudTrail for anomalous API activity from 8 August 2026 onwards, particularly authentication or activity using credentials previously stored in or accessible through Cadence. Rotate and disable any IAM user not strictly required.
4. **Review PyCharm-synchronised projects:** any project uploaded or synchronised from PyCharm to Cadence should be treated as potentially exposed — assume embedded credentials, configurations and the code itself are compromised; rotate anything hardcoded or configured in those projects.

### P1 — within 24 hours (all clients, regardless of Cadence usage)

1. **Patch TeamCity.** CVE-2026-63077 is KEV-listed and under active exploitation. Identify every TeamCity instance (on-prem and cloud) in your estate — including build servers supporting regulated workloads — and patch to a fixed version. If patching cannot complete within 24 hours, isolate the instance: restrict network access to the TeamCity HTTP(S) port to trusted admin/CI networks only, or take the instance offline. Do not expose TeamCity to the public internet.
2. **Hunt for exploitation** on all TeamCity instances: review server logs for unauthenticated deserialization attempts and unexpected OS command execution by the TeamCity server process from 5 August 2026 (KEV listing) onwards. Treat any unpatched, internet-facing instance as presumptively compromised.

### P2 — within 72 hours

1. **Verify token invalidation:** JetBrains has invalidated all access tokens used by the Cadence plugin in PyCharm. Confirm your developers' PyCharm Cadence plugins are not holding stale sessions; re-authenticate only after credential rotation is complete.
2. **Review third-party risk posture for JetBrains-hosted services** in your vendor inventory: identify which teams used Cadence, what credentials were exposed to it, and whether any regulated data or production source code was synchronised.

### P3 — within 7 days

1. **Enforce network segmentation** for all CI/CD tooling: TeamCity and equivalent build servers should never be internet-facing; place them behind VPN or IP allow-listing.
2. **Add CVE-2026-63077 to your vulnerability-management SLA as a KEV-driven emergency patch item** and confirm closure across the estate.

## 5\. Indicators of compromise

JetBrains shared a partial IOC set; the source material provides the behavioural indicator below but no atomic values (IP addresses were referenced but not enumerated in the material available to us). Do not act on unspecified "IP addresses" — obtain the full list from JetBrains' disclosure directly.

### Behavioural indicators

| Behaviour                                                                                                                             | Where to observe                                           | Confidence           |
| ------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | -------------------- |
| Authentication or activity using credentials previously stored in or accessible through Cadence, occurring from 8 August 2026 onwards | AWS CloudTrail, IdP logs, CI/CD audit logs, S3 access logs | High (vendor-stated) |

No atomic indicators of compromise available in the source material.

## 6\. Detection

Insufficient indicators to author detection rules. The source material contains no atomic artefacts (no hashes, strings, command lines, file paths, or enumerated IP addresses) usable to build a YARA or Sigma rule. Detection should instead operationalise the behavioural indicator in §5: alert on authentication events using credentials known to have been exposed to Cadence, and on anomalous AWS IAM/API activity from 8 August 2026 onwards.

## 7\. Sources

- The Hacker News — "Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials" — https://thehackernews.com/2026/09/attackers-breached-jetbrains-cadence.html — 2026-09-05
- SecurityWeek — "Hackers Start Exploiting Recent JetBrains TeamCity Vulnerability" — https://www.securityweek.com/hackers-start-exploiting-recent-jetbrains-teamcity-vulnerability/ — (corroborates CVE-2026-63077 unauthenticated RCE and active exploitation)

## 8\. Adverse Trace position

This is a high-severity incident with direct relevance to EMEA financial services on two axes: any client running an unpatched TeamCity instance is exposed to a KEV-listed, unauthenticated RCE (CVSS 9.8) under active exploitation — treat as an emergency patch item and hunt for compromise now; and any client that used JetBrains Cadence must assume its AWS credentials, secrets and PyCharm-synchronised source code are compromised and rotate accordingly, with CloudTrail review from 8 August 2026\. The breach-detail claims are single-sourced (JetBrains' own disclosure) — verify against JetBrains' primary advisory and the full IOC list before enforcement action, and note that attribution is unconfirmed with no MITRE ATT&CK profile available. We will monitor for the full IOC release, any patch-version specifics for CVE-2026-63077, and further reporting on the actor's use of the extracted AWS credentials; updates will follow as a version increment to this advisory.

---

[Read the original source →](https://thehackernews.com/2026/09/attackers-breached-jetbrains-cadence.html?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*