JetBrains Cadence Breach via Unpatched TeamCity Exploitation

Technical Analysis

The attackers leveraged an unpatched, recently disclosed critical vulnerability in JetBrains TeamCity, a widely used CI/CD server, to gain unauthorized access to JetBrains' internal infrastructure hosting the Cadence service. Because Cadence executes customer build and deployment pipelines, the breach likely exposed AWS credentials, API keys, and other secrets stored or transmitted during Cadence job runs. This is a classic CI/CD supply-chain compromise pattern: attackers target build infrastructure to harvest secrets that grant downstream access to customer cloud environments and connected services. Organizations that use TeamCity/Cadence pipelines to build, test, or deploy AI agent frameworks, LLM tool-use integrations, or RAG pipelines should treat any AWS keys, API tokens, or model-provider credentials handled by these pipelines as compromised, since stolen credentials could be used to hijack agent infrastructure, exfiltrate proprietary models/data, or pivot into connected cloud resources.

Affected Systems

JetBrains TeamCity (unpatched instances vulnerable to the recently disclosed critical CVE), JetBrains Cadence CI/CD service, customer AWS accounts and credentials used within Cadence pipeline executions

Indicators of Compromise

• No specific hashes, IPs, or domains disclosed in available reporting; monitor JetBrains official advisories for updated IOCs

Remediation Steps

1. 1

   Rotate all credentials

   Immediately revoke and rotate all AWS credentials, API keys, and secrets used in any Cadence pipeline executions.

2. 2

   Patch TeamCity

   Apply the latest TeamCity security patches to remediate the critical vulnerability referenced by JetBrains; verify no unpatched instances remain internet-facing.

3. 3

   Audit pipeline activity

   Review Cadence and TeamCity build logs for unauthorized executions, unusual outbound network activity, or unexpected credential usage during the incident window.

4. 4

   Restrict secret exposure in CI/CD

   Implement short-lived, scoped credentials (e.g., AWS STS tokens) instead of long-lived static keys within CI/CD pipelines, including those feeding AI agent or RAG deployment workflows.

5. 5

   Monitor for downstream abuse

   Enable enhanced monitoring on AWS CloudTrail and connected services for anomalous API calls tied to potentially compromised credentials, particularly around agent orchestration or model-serving infrastructure.