Citrix security breach sees 6TB of sensitive data stolen
Citrix has suffered a cyber attack that resulted in the loss of 6TB worth of data including emails, blueprints and other business documents.
In an official but brief statement, Stan Black, Citrix CISO, said that the Federal Bureau of Investigation (FBI) had alerted the company to the possibility that its systems had been compromised in the middle of last week.
In Citrix's initial statement, it was only understood that its systems had been compromised and documents may have been stolen. It wasn't until cyber security firm Resecurity released a statement regarding the extent of the damage and who was behind it.
Resecurity claimed to have first alerted Citrix to early warning signs of a data breach back on 28 December 2018 and since then, continued to present its findings to the FBI and Citrix, which has clients including businesses, the American military and government departments.
"Citrix has taken action to contain this incident," it said in the statement. "We commenced a forensic investigation; engaged a leading cyber security firm to assist; took actions to secure our internal network; and continue to cooperate with the FBI."
"Citrix is moving as quickly as possible, with the understanding that these investigations are complex, dynamic and require time to conduct properly. In investigations of cyber incidents, the details matter, and we are committed to communicating appropriately when we have what we believe is credible and actionable information.
"While our investigation is ongoing, based on what we know to date, it appears that the hackers may have accessed and downloaded business documents. The specific documents that may have been accessed, however, are currently unknown. At this time, there is no indication that the security of any Citrix product or service was compromised."
Resecurity attributed the attack to the Iranian hacking group IRIDIUM which, according to Citrix, used a password spraying technique to establish an initial foothold before circumventing further security layers.
Password spraying is slightly different from a brute force attack which involves targeting a single account and launching a barrage of different passwords at it, in the hope of one unlocking the account. Password spraying targets many accounts by throwing commonly used passwords their way to see if any of them work.
"The incident has been identified as a part of a sophisticated cyber espionage campaign supported by nation-state due to strong targeting on government, military-industrial complex, energy companies, financial institutions and large enterprises involved in critical areas of economy," read the blog post from Resecurity.
"Based our recent analysis, the threat actors leveraged a combination of tools, techniques and procedures (TTPs) allowing them to conduct targeted network intrusion to access at least 6 terabytes of sensitive data stored in the Citrix enterprise network, including e-mail correspondence, files in network shares and other services used for project management and procurement.
"The arsenal of IRIDIUM includes proprietary techniques allowing to bypass 2FA authorisation for critical applications and services for further unauthorized access to VPN (Virtual Private Networks) channels and SSO (Single Sign-On)."
The investigation is in the early stages of progression but Citrix has vowed to remain compliant with the FBI and to provide its customers with regular updates on the case.
A wider view
There is speculation around whether the attack originated from Iranian sources at all. Resecurity had previously attributed the attack on the Australian government's computers to state-backed IRIDIUM. However, sources close to the case had said that the attack seemed to have been at the hands of China, or a group posing as the Chinese perhaps.
However, Microsoft last week also spoke out against Iranian-linked hackers. Speaking to the Wall Street Journal, the tech giant said Iranian hackers had targeted 'hundreds of thousands of people at more than 200 companies over the past two years.
When we see data breaches reported near-daily, it's easy to become desensitised to the stories, but let's not undermine the significance of a breach this large. 6TB of data is a mammoth amount especially for a company with such high-profile clients as Citrix. The amount of data totally eclipses that released in the recent 'Collections' data leaks as reported by IT Pro earlier this year.
Citrix also has clients in Europe, including multi-national law firms which should set GDPR red flag alarms ringing. While the investigation is still in its infancy, there is the possibility, with a stolen dataset this large, that some of the data could belong to EU citizens which could mean a substantial fine could be levied at Citrix if it was found to have breached data security and breach management and reporting rules enshrined in GDPR.
source itpro
Industry: Cyber Security News
Latest Jobs
-
- VOIP / SIP App Developer. Contract. SIP | VOIP experience needed. SC Cleared Outside IR35 Contract. London
- London
- OUTSIDE IR35
-
SIP | VOIP Developer. SC Cleared Contract. London Looking for a SC Cleared SIP / VOIP Developer to develop an application that interacts with a set of voice and video signalling API’s You will also work on developing in-house applications, browser plugins and automated tooling to support secure communication systems. Responsibilities Develop an application that will manage number mapping and associated identities using commercial SBC API’s. Develop new user-facing features using React.js or other modern JavaScript frameworks. Build reusable components and front-end libraries for future use. Collaborate with the design team to translate UI/UX design wireframes into code. Work closely with backend developers to integrate front-end code with server-side logic. Conduct code reviews and provide constructive feedback to team members. Stay up-to-date on emerging technologies and industry trends to continuously improve our front-end development practices. Troubleshoot and debug issues that arise during development and in production environments. Maintain high coding standards and practices and ensure code is well-documented. Requirement Experience of developing specialist applications using REST API’s. Good knowledge of Go, Java and Python (open to alternative combinations of languages). Proficiency in front-end languages and frameworks such as HTML, CSS, JavaScript, React.js, etc. Strong understanding of web standards, responsive design, and cross-browser compatibility. Experience with version control systems such as Git. Knowledge of RESTful APIs and asynchronous request handling. Familiarity with UI/UX design principles and tools.
-
- Senior Data Privacy Consultant. Client Facing | London
- London
- N/A
-
Senior Data Privacy Consultant. Client Facing | London Senior Data Privacy Consultant needed for a key client facing opportunity. Must be willing to undergo SC Security Clearance. Hybrid role- onsite with customer / office 2-3 days a week. London Key Responsibilities: Lead and support client facing data privacy projects. Assess compliance, define and deliver strategic projects / implement privacy solutions. Manage project teams and develop business opportunities. Required Experience: Experience in data protection and privacy standards. Background in consulting. Skills and Qualifications: Business consulting experience IAPP Privacy Manager / Privacy Technologist Location Greater London UK based role. Not able to provide VISA sponsorship.
-
- Security Analyst - Internal role. London commutable. Permanent
- London
- N/A
-
Security Analyst - Internal role. London commutable opportunity. Operational Security - Investigate, escalate and proactively work to ensure household name remains protected. Project Security - Coordinate, log change requests with project delivery teams to meet security requirements Policy / compliance - work with team to aid in uplifting these as and where needed This role is role to investigate, escalate and proactively work to protect a globally recognised brand. You must have current hands on operational analytical security experience with Microsoft technology stack Someone with a SOC Analyst / security engineering background would be well suited. This position will join a small team and would suit someone that has broad experience across the security threat landscape. Experience / knowledge across industry GRC standards such NIST, ISO27001 etc very advantageous and a priority. You will work across multiple teams proactively working to secure the business. Must be able to commute to Central London 3 days a week. Visa sponsorship not available Apply today to find out more.
-
- Network / Security Infrastructure Engineer | West London | Permanent
- London
- N/A
-
Network / Security Infrastructure Engineer | West London | Current Config, Install, upgrade experience On prem / Datacetner experience essential. Hands on experience MUST include: Routing, Switching, Network Security (firewall, IDS etc), Microsoft exchange / Exchange 365. Scripting / automation experience wanted. Python, Powershell etc Regular travel to West London is required. Visa sponsorship not available. Apply today for more information chris.holt@dclsearch.com Use this whatapp link to reach out https://wa.me/message/6USF5RAQBOZIP1