BleepingComputer (2026-09-24): CISA updated KEV on Wednesday Sep 23 to flag critical JetBrains TeamCity On-Premises CVE-2026-63077 as abused by ransomware gangs (no public group names or campaign IoCs yet). JetBrains patched on July 25 in 2025.11.7 and 2026.1.3 — an authentication bypass via the agent polling protocol that lets an unauthenticated attacker with HTTP(S) access run OS commands as the TeamCity server process, with risk to data, configs, stored credentials, build artifacts, and downstream CI/CD. CISA first added the CVE to KEV on Aug 5 (FCEB due Aug 8); JetBrains confirmed in-the-wild exploitation Aug 7. Shadowserver now tracks just over ~160 internet-exposed TeamCity hosts still unpatched (down from ~700 right after the patch). Since Oct 2023, CISA has tagged four TeamCity issues as exploited in the wild — all later also tied to ransomware abuse.
Separately (The Hacker News / Aikido, 2026-09-22–23): Go-based malware shipped through two Terraform providers on HashiCorp’s public registry — gocommunity-io/dockerd (222 downloads) and typosquat kreuzwenker/docker vs legitimate kreuzwerker/docker (1,449 downloads) — plus Go modules gocommunity.io/orderedbtree and gogets.dev/btreex. Aikido calls this the first observed malware distribution via HashiCorp’s centralized Terraform registry. The implant is a Go port overlapping the Graphalgo campaign (ReversingLabs, Feb 2026; recent npm samples covered by Checkmarx, JFrog, SafeDep): gated activation, dual C2 via Slack bot API and blockchain dead drops (Arbitrum Sepolia), fingerprinting, and remote Go/JS execution. Socket’s Karlo Zanki told THN it is too early to conclude DPRK-linked actors are adopting Terraform registries at scale, though overlap with recent TraderTraitor/SentinelOne Terraform findings makes coincidence less likely; Contagious Interview–style fake-job social engineering remains the reported primary access playbook.
Livermore takeaway: inventory every TeamCity On-Premises instance (especially internet-exposed), confirm ≥2025.11.7 or ≥2026.1.3, and restrict agent-polling exposure if you cannot patch today — then hunt unauthorized “scan” agents on any host that was exposed before patch. On the IaC side: pin/verify Terraform provider source addresses (watch typosquats of kreuzwerker/*), block unknown providers in CI, and if any listed package ran on a laptop or runner — isolate, rotate cloud/IaC/Git tokens, and reimage.