#apt29

Analysis · May 20, 2026 · Colten Anderson

The SolarWinds crew spent late 2023 breaking into build servers. That's not a coincidence.

CVE-2023-42793 is an unauthenticated RCE on JetBrains TeamCity. APT29, the Russian service behind SolarWinds, exploited it at scale, and so did North Korean groups. They weren't after one network. A build server is the supply chain.