TeamCity Ransomware, Roundcube Exploitation, and ClickFix Social Engineering

TeamCity Ransomware, Roundcube Exploitation, and ClickFix Social Engineering

•

Episode description

TeamCity Ransomware, Roundcube Exploitation, and ClickFix Social Engineering

CISA confirms ransomware gangs are actively exploiting a critical JetBrains TeamCity vulnerability patched in July, eleven weeks after the fix became available. UK SMBs face supply chain exposure through managed service providers and development partners with access to production environments. Meanwhile, the Canadian Centre for Cyber Security reports active exploitation of a four-month-old Roundcube Webmail code injection flaw that requires no user interaction beyond reading email. The ClickFix social engineering technique continues to deliver multiple malware families including PavinLoader and AvisLoader, which uses peer-to-peer infrastructure designed to outlast traditional takedown responses. This briefing examines the persistent gap between patch availability and patch application, and provides actionable guidance for UK small and medium businesses on verifying third-party patch status, confirming email infrastructure security, and implementing staff awareness controls that technical measures cannot replace.

Chapters

  • Introduction Overview of three active threats exploiting the gap between patch availability and application: JetBrains TeamCity ransomware exploitation, Roundcube Webmail active attacks, and the persistent ClickFix social engineering campaign.
  • TeamCity Ransomware Exploitation CISA confirms ransomware groups are exploiting a critical TeamCity RCE vulnerability eleven weeks after the July patch. Examination of supply chain exposure for UK SMBs through managed service providers and development partners with access to production environments.
  • Call to Action Encouragement to follow the show and share the briefing with colleagues who need threat intelligence.
  • Roundcube Webmail Active Exploitation Canadian Centre for Cyber Security reports active exploitation of CVE-2026-48842, a code injection vulnerability in Roundcube Webmail, four months after the May patch. Analysis of the attack surface and guidance for UK SMBs using hosted email infrastructure.
  • ClickFix Social Engineering Campaign Examination of the ClickFix technique as initial access vector across multiple malware campaigns including PavinLoader and AvisLoader. Guidance on staff awareness training as the primary defence against social engineering that technical controls cannot prevent.
  • AI Command and Control Research Brief assessment of Cisco Talos CLOSEDQUORUM research on AI-directed malware. Clarification that this remains proof-of-concept rather than an operational threat currently observed in the wild.
  • Summary and Closing Recap of actionable steps for TeamCity patch verification, Roundcube infrastructure security confirmation, and ClickFix staff briefing. Emphasis on the effectiveness of asking the right questions over technical complexity.

Links