CVE-2023-42793CampaignPublished 4 Sep 2025Updated 4 Oct 2025

JetBrains TeamCity · Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms

Affects JetBrains TeamCitySource AlienVault OTX General

Authoritative record:CVE-2023-42793· Critical 9.8

Exploited in the wild · used in ransomware campaigns · KEV due 25 Oct 2023 · public exploit available (Metasploit, Exploit-DB) · 99% EPSS : block it and hunt for it in your logs now.

Data as of 26 Oct 2026, 06:26 UTC

CVSS base score

9.8Critical

How severe the flaw is on the 0–10 CVSS scale.

KEV deadline: 25 Oct 2023 US federal agencies must patch by this date; a sensible deadline for everyone else.
Ransomware: Used in ransomware campaigns
EPSS: 99.9% chance of exploitation in 30 days – higher than 99% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 19 Sep 2023
Detectable: evidence found.
nuclei template: JetBrains TeamCity < 2023.05.4 - Remote Code Execution
Weaponised: evidence found.
1 Metasploit module · 1 Exploit-DB entry, 177 days after disclosure
Exploited in the wildExploited: evidence found.
Listed in CISA KEV 15 days after disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

CVE published
on cve.org
2023-09-1916:57Z, t = 0
Added to CISA KEV (opens in a new tab)
exploitation confirmed · ransomware use known
2023-10-04, 15 days after disclosure
In Threat Radar
record ingested
2023-10-0500:00Z, 16 days after disclosure
KEV remediation due
US federal deadline
2023-10-25, 36 days after disclosure
First Exploit-DB entry (opens in a new tab)
JetBrains TeamCity 2023.05.3 - Remote Code Execution (RCE)
2024-03-14, 177 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade JetBrains TeamCity to 2023.05.4.

Affected software

Product	Affected	Fixed in
JetBrainsTeamCity	Affected <2023.05.4	Fixed in 2023.05.4

Description

The Contagious Interview campaign is a coordinated cyber espionage operation by North Korean threat actors, notably linked to the Lazarus group, targeting the cryptocurrency sector. These actors actively monitor cyber threat intelligence platforms such as Validin, VirusTotal, and Maltrail to identify exposed infrastructure and new targets. They prioritize rapid deployment of malicious infrastructure over stealth and use social engineering techniques, including the ClickFix method, to trick victims into executing malware. Between January and March 2025, over 230 victims were engaged, demonstrating the campaign's scale and sophistication. Although no known exploits for CVE-2023-42793 have been observed in the wild, the campaign poses a medium severity threat. European cryptocurrency organizations, especially in countries with significant crypto markets and financial sectors, are at risk. Mitigation requires targeted monitoring of threat intelligence platforms, enhanced user training against social engineering, and rapid incident response capabilities.

Impact

For European organizations, particularly those in the cryptocurrency sector, this campaign presents a significant risk of data theft, financial loss, and operational disruption. The actors’ ability to rapidly deploy infrastructure and use sophisticated social engineering increases the likelihood of successful compromise. Compromised organizations may face theft of cryptocurrency assets, exposure of sensitive financial data, and potential reputational damage. The use of cyber threat intelligence platforms by attackers to identify exposed infrastructure means that organizations with publicly accessible or poorly secured assets are at heightened risk. The campaign’s scale, with over 230 victims engaged in a short period, indicates a broad targeting approach that could affect multiple European countries with active crypto markets. Additionally, the espionage component could lead to theft of intellectual property or strategic information, impacting competitive positioning and regulatory compliance. The medium severity rating reflects the absence of known active exploits but does not diminish the threat posed by social engineering and infrastructure reconnaissance, which can facilitate future, more damaging attacks.

Defensive guidance

European organizations should implement targeted monitoring of cyber threat intelligence platforms to detect if their infrastructure is being scanned or referenced by threat actors. Enhanced user training focused on recognizing and resisting social engineering attacks, particularly the ClickFix technique, is critical. Organizations should enforce strict access controls and multi-factor authentication to reduce the risk of credential compromise. Rapid incident response capabilities must be established to quickly isolate and remediate compromised systems. Regular audits of publicly exposed infrastructure and vulnerability scanning should be conducted to minimize attack surface. Collaboration with industry information sharing groups can provide early warnings and indicators of compromise related to this campaign. Additionally, organizations should review and harden their cryptocurrency transaction and wallet security practices to mitigate financial theft risks. Given the actors’ use of Slack for coordination, monitoring internal collaboration tools for suspicious activity may also be beneficial. Finally, organizations should stay updated on patches and advisories related to CVE-2023-42793, even though no active exploits are currently reported.

Public tooling indexed from Metasploit Framework, Exploit-DB and ProjectDiscovery nuclei-templates. Its existence raises the odds of exploitation; it does not confirm attacks.

CWE-288Authentication Bypass Using an Alternate Path or Channel (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
Architecture and Design
Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
OWASP Cheat Sheets
OWASP Authentication (opens in a new tab)
OWASP ASVS 4.0.3
V1.2.3 (opens in a new tab)
V1.2.2 (opens in a new tab)
V1.2.4 (opens in a new tab)
Attack patterns
Directory Indexing (opens in a new tab)
Exploitation of Thunderbolt Protection Flaws (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

Indicators of compromise

Domains 3,371

028xmz.com
0xraiseup.com
118274-zoomid.com
11stnft.click
15248636.site
1687715624.inc
1688dsj.com
168wangpi.com
1drvmicrosoft.com
247l.net

Hashes 461

76c3d2092737d964dfd627f1ced0af80
cb9e18e21226a89ce2c26c695a989e0d
61d1a5b8f242706a39d06316e4c66b01141b4ab3
ec062c8c6e77808ee2b3573f91eede294d572509
bffe910904efd1f69544daa9b72f2a70fb29f73c51070bde4ea563de862ce4b1
f78cabf7a0e7ed3ef2d1c976c1486281f56a6503354b87219b466f2f7a0b65c4
04d0856afb1aa9168377d6aa579c5403
2d1f1132ab7e80a6a8546dd2ac45bd89
792370eb01e16ac3dc511143932d0e1d
b4c9b903dfd18bd67a3824b0109f955b

CVEs 1

CVE-2023-42793

Community reviews

Loading reviews…

Exploitation evidence

Timeline

What to do

Affected software

Description

AI analysisMachine-generated, updated 28 Oct 2025, 19:20 UTC

Public exploits and detection1 Metasploit module, 1 Exploit-DB entry, a Nuclei detection template

WeaknessesCWE-288

MITRE ATT&CK techniques11 from threat tags

Technical details

Indicators of compromise

Domains 3,371

Hashes 461

CVEs 1

Community reviews

Related threats