Full Report
Cadence uses JetBrains TeamCity to orchestrate cloud workloads, and the affected server, api.cadence.jetbrains.com, remained vulnerable to CVE-2026-63077 despite having been intended for patching. Threat actors exploited the vulnerability beginning on August 8 to gain unauthor...
Analysis Summary
# Incident Report: JetBrains Cadence Compromised via TeamCity Vulnerability
## Executive Summary
JetBrains’ Cadence service was compromised after threat actors exploited a critical vulnerability (CVE-2026-63077) in an unpatched TeamCity server. The breach resulted in the exfiltration of user PII, a full 2024 server backup, and AWS credentials that granted unauthorized access to S3 buckets. While the server was intended for patching, it remained vulnerable, leading to a supply chain risk and significant exposure of cloud infrastructure secrets.
## Incident Details
- **Discovery Date:** August 23, 2026
- **Incident Date:** August 8, 2026 (Initial Exploitation)
- **Affected Organization:** JetBrains (Cadence Service)
- **Sector:** Software Development / Technology
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** August 8, 2026
- **Vector:** Exploitation of CVE-2026-63077
- **Details:** Attackers targeted the server `api[.]cadence[.]jetbrains[.]com`, which was running a vulnerable version of JetBrains TeamCity despite internal intentions to patch the system.
### Lateral Movement
- **Cloud Escalation:** Attackers used exposed AWS IAM users and secrets found within a 2024 backup to move laterally into JetBrains' AWS environment.
- **Resource Access:** This enabled unauthorized access to various S3 buckets belonging to JetBrains AWS accounts.
### Data Exfiltration/Impact
- **PII Leak:** Usernames, real names, email addresses, login timestamps, and source IP addresses were exfiltrated.
- **Backup Theft:** A 2024 Cadence server backup containing credentials, configurations, artifacts, and logs was stolen.
- **Source Code:** Potential access to source code synchronized from PyCharm projects.
### Detection & Response
- **Discovery:** JetBrains detected suspicious activity on August 23, 2026.
- **Containment:** The affected server was taken offline on August 24, 2026.
- **Disclosure:** Public disclosure and status finalization occurred between August 31 and September 7, 2026.
## Attack Methodology
- **Initial Access:** Exploitation of a 1-day vulnerability (CVE-2026-63077) in TeamCity.
- **Persistence:** Not explicitly detailed, but likely maintained via compromised AWS IAM credentials.
- **Privilege Escalation:** Accessing server backups to retrieve administrative credentials and AWS IAM secrets.
- **Defense Evasion:** Not detailed; however, the vulnerability was exploited for 15 days before detection.
- **Credential Access:** Extraction of multiple AWS IAM users and associated secrets from legacy backups and logs.
- **Discovery:** Reconnaissance of cloud workloads and S3 bucket contents via compromised IAM keys.
- **Lateral Movement:** Pivoting from the TeamCity server to JetBrains' AWS cloud infrastructure.
- **Collection:** Gathering personal data, server backups, and synchronized project artifacts.
- **Exfiltration:** Transfer of PII and large backup files from the environment.
- **Impact:** Potential supply chain compromise and exposure of cloud infrastructure.
## Impact Assessment
- **Financial:** Costs associated with incident response, forensic auditing, and potential regulatory fines for PII exposure.
- **Data Breach:** Exposure of real names, emails, and sensitive technical artifacts (logs, configs, backups).
- **Operational:** The `api[.]cadence[.]jetbrains[.]com` server was taken offline, disrupting services.
- **Reputational:** High impact due to JetBrains' role in the software supply chain and the failure to apply intended patches.
## Indicators of Compromise
- **Network Indicators:**
- `api[.]cadence[.]jetbrains[.]com` (Compromised Endpoint)
- **File Indicators:** 2024 Cadence server backup files.
- **Behavioral Indicators:**
- Unauthorized API calls to AWS S3 from Cadence-associated IAM users.
- Exploitation attempts targeting CVE-2026-63077.
## Response Actions
- **Containment:** Decommissioned the vulnerable server on August 24.
- **Eradication:** Revocation of all AWS IAM users and secrets identified in the compromised 2024 backup.
- **Recovery:** Auditing S3 bucket access logs to determine the extent of data theft and refreshing all secrets stored in the Cadence environment.
## Lessons Learned
- **Patch Management Gap:** There was a failure in the deployment pipeline where a server "intended for patching" remained vulnerable in a production-facing environment.
- **Legacy Data Risks:** The presence of a 2024 backup on a reachable server provided attackers with long-term credentials that were still valid for current cloud environments.
- **Secret Hygiene:** Storing IAM secrets in logs or backups without sufficient encryption or rotation intervals facilitated lateral movement.
## Recommendations
- **Automated Patch Verification:** Implement automated scanning to verify that high-criticality patches (like those for TeamCity) are successfully applied across all endpoints.
- **Data Minimization:** Encrypt or remove legacy backups from internet-facing production servers.
- **IAM Hardening:** Enforce short-lived credentials (STS tokens) for cloud workloads instead of long-lived IAM secret keys.
- **Secret Rotation:** Immediately rotate all secrets, certificates, and credentials that were stored in or processed by the Cadence environment.