Writeup of the actual attack malware running on the build servers: https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/ https://www.crowdstrike

Writeup of the actual attack malware running on the build servers: https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/ https://www.crowdstrike.com/blog/sunspot-malware-technical-a... It attacked MSBUILD.EXE processes on startup, and it didn't matter if they were started by TeamCity or by a homebrew script in Powershell.