Citrix security breach sees 6TB of sensitive data stolen
Citrix has suffered a cyber attack that resulted in the loss of 6TB worth of data including emails, blueprints and other business documents.
In an official but brief statement, Stan Black, Citrix CISO, said that the Federal Bureau of Investigation (FBI) had alerted the company to the possibility that its systems had been compromised in the middle of last week.
In Citrix's initial statement, it was only understood that its systems had been compromised and documents may have been stolen. It wasn't until cyber security firm Resecurity released a statement regarding the extent of the damage and who was behind it.
Resecurity claimed to have first alerted Citrix to early warning signs of a data breach back on 28 December 2018 and since then, continued to present its findings to the FBI and Citrix, which has clients including businesses, the American military and government departments.
"Citrix has taken action to contain this incident," it said in the statement. "We commenced a forensic investigation; engaged a leading cyber security firm to assist; took actions to secure our internal network; and continue to cooperate with the FBI."
"Citrix is moving as quickly as possible, with the understanding that these investigations are complex, dynamic and require time to conduct properly. In investigations of cyber incidents, the details matter, and we are committed to communicating appropriately when we have what we believe is credible and actionable information.
"While our investigation is ongoing, based on what we know to date, it appears that the hackers may have accessed and downloaded business documents. The specific documents that may have been accessed, however, are currently unknown. At this time, there is no indication that the security of any Citrix product or service was compromised."
Resecurity attributed the attack to the Iranian hacking group IRIDIUM which, according to Citrix, used a password spraying technique to establish an initial foothold before circumventing further security layers.
Password spraying is slightly different from a brute force attack which involves targeting a single account and launching a barrage of different passwords at it, in the hope of one unlocking the account. Password spraying targets many accounts by throwing commonly used passwords their way to see if any of them work.
"The incident has been identified as a part of a sophisticated cyber espionage campaign supported by nation-state due to strong targeting on government, military-industrial complex, energy companies, financial institutions and large enterprises involved in critical areas of economy," read the blog post from Resecurity.
"Based our recent analysis, the threat actors leveraged a combination of tools, techniques and procedures (TTPs) allowing them to conduct targeted network intrusion to access at least 6 terabytes of sensitive data stored in the Citrix enterprise network, including e-mail correspondence, files in network shares and other services used for project management and procurement.
"The arsenal of IRIDIUM includes proprietary techniques allowing to bypass 2FA authorisation for critical applications and services for further unauthorized access to VPN (Virtual Private Networks) channels and SSO (Single Sign-On)."
The investigation is in the early stages of progression but Citrix has vowed to remain compliant with the FBI and to provide its customers with regular updates on the case.
A wider view
There is speculation around whether the attack originated from Iranian sources at all. Resecurity had previously attributed the attack on the Australian government's computers to state-backed IRIDIUM. However, sources close to the case had said that the attack seemed to have been at the hands of China, or a group posing as the Chinese perhaps.
However, Microsoft last week also spoke out against Iranian-linked hackers. Speaking to the Wall Street Journal, the tech giant said Iranian hackers had targeted 'hundreds of thousands of people at more than 200 companies over the past two years.
When we see data breaches reported near-daily, it's easy to become desensitised to the stories, but let's not undermine the significance of a breach this large. 6TB of data is a mammoth amount especially for a company with such high-profile clients as Citrix. The amount of data totally eclipses that released in the recent 'Collections' data leaks as reported by IT Pro earlier this year.
Citrix also has clients in Europe, including multi-national law firms which should set GDPR red flag alarms ringing. While the investigation is still in its infancy, there is the possibility, with a stolen dataset this large, that some of the data could belong to EU citizens which could mean a substantial fine could be levied at Citrix if it was found to have breached data security and breach management and reporting rules enshrined in GDPR.
Industry: Cyber Security News
- CONTRACT SIEM Cyber Security Operations Engineer. REMOTE
- United Kingdom
REFCH8165 CONTRACT SIEM Cyber Security Operations Engineer. REMOTE UK SIEM Engineer. 6 month Contract. Inside IR35 Working towards a "SOC 2" environment. CLOUD (AWS) experience essential. Three key functions; Monitor, Escalate and Triage incidents. Vulnerability Management / threat intel. SIEM configuration / management, review, enhancement More specifically; Work with internal teams to identify assets. Identity applicable threat feeds and work with internal teams to remediate. Patch Patch Patch. (Help mature process / identify gaps) Configuration / fine tuning of SIEM alerts. Create dashboards, Compliance reporting. Log ingestion. Experience across ISO27001 / SOC2 / SIEM / End Point Security is essential Contact me today for more information Chris.Holt@dclsearch.com Or 07884666351
- Cyber Security Operations Engineer. REMOTE UK. SOC2
- United Kingdom
REF8164 Cyber Security Operations Engineer. REMOTE UK Internal opportunity. New position. Exclusive to DCL Search. You will be the hands on technical eyes and ears of the Cyber security capability actively working to ensure and enhance the adherence to ISO27001 and "SOC 2" controls. You role will touch on the following · Security Monitoring- SIEM · Vulnerability Management / Testing · Incident Management · Asset management · Disaster Recovery planning · Change Management AWS Cloud experience is essential as is the ability to ensure patch management is prioritised across the business. Any CLOUD SIEM experience highly desirable. Contact me today for more information Chris.Holt@dclsearch.com Or 07884666351
- Lead Security Architect
- United Kingdom
Engage with key clients in an Architectural / technical presales capacity. Including Stakeholders, end users / partners. Working on new and existing Security projects to confirm that proposed solutions are fit for purpose from both a technical and regulatory capacity. Working closely with multiple vendor . Managed security service background ideal CLOUD Security (AZURE OR AWS), IDAM background ideal.
- Threat Vulnerability Management Analyst
- United Kingdom
To monitor, identify and alert internal teams of cyber threats and vulnerabilities. MIRE Att&ck, CIS, OWASP, Vulnerability management tools MUST be able to commute to central London MUST be able to achieve UK SC Clearance. On going support and development.