Citrix security breach sees 6TB of sensitive data stolen
Citrix has suffered a cyber attack that resulted in the loss of 6TB worth of data including emails, blueprints and other business documents.
In an official but brief statement, Stan Black, Citrix CISO, said that the Federal Bureau of Investigation (FBI) had alerted the company to the possibility that its systems had been compromised in the middle of last week.
In Citrix's initial statement, it was only understood that its systems had been compromised and documents may have been stolen. It wasn't until cyber security firm Resecurity released a statement regarding the extent of the damage and who was behind it.
Resecurity claimed to have first alerted Citrix to early warning signs of a data breach back on 28 December 2018 and since then, continued to present its findings to the FBI and Citrix, which has clients including businesses, the American military and government departments.
"Citrix has taken action to contain this incident," it said in the statement. "We commenced a forensic investigation; engaged a leading cyber security firm to assist; took actions to secure our internal network; and continue to cooperate with the FBI."
"Citrix is moving as quickly as possible, with the understanding that these investigations are complex, dynamic and require time to conduct properly. In investigations of cyber incidents, the details matter, and we are committed to communicating appropriately when we have what we believe is credible and actionable information.
"While our investigation is ongoing, based on what we know to date, it appears that the hackers may have accessed and downloaded business documents. The specific documents that may have been accessed, however, are currently unknown. At this time, there is no indication that the security of any Citrix product or service was compromised."
Resecurity attributed the attack to the Iranian hacking group IRIDIUM which, according to Citrix, used a password spraying technique to establish an initial foothold before circumventing further security layers.
Password spraying is slightly different from a brute force attack which involves targeting a single account and launching a barrage of different passwords at it, in the hope of one unlocking the account. Password spraying targets many accounts by throwing commonly used passwords their way to see if any of them work.
"The incident has been identified as a part of a sophisticated cyber espionage campaign supported by nation-state due to strong targeting on government, military-industrial complex, energy companies, financial institutions and large enterprises involved in critical areas of economy," read the blog post from Resecurity.
"Based our recent analysis, the threat actors leveraged a combination of tools, techniques and procedures (TTPs) allowing them to conduct targeted network intrusion to access at least 6 terabytes of sensitive data stored in the Citrix enterprise network, including e-mail correspondence, files in network shares and other services used for project management and procurement.
"The arsenal of IRIDIUM includes proprietary techniques allowing to bypass 2FA authorisation for critical applications and services for further unauthorized access to VPN (Virtual Private Networks) channels and SSO (Single Sign-On)."
The investigation is in the early stages of progression but Citrix has vowed to remain compliant with the FBI and to provide its customers with regular updates on the case.
A wider view
There is speculation around whether the attack originated from Iranian sources at all. Resecurity had previously attributed the attack on the Australian government's computers to state-backed IRIDIUM. However, sources close to the case had said that the attack seemed to have been at the hands of China, or a group posing as the Chinese perhaps.
However, Microsoft last week also spoke out against Iranian-linked hackers. Speaking to the Wall Street Journal, the tech giant said Iranian hackers had targeted 'hundreds of thousands of people at more than 200 companies over the past two years.
When we see data breaches reported near-daily, it's easy to become desensitised to the stories, but let's not undermine the significance of a breach this large. 6TB of data is a mammoth amount especially for a company with such high-profile clients as Citrix. The amount of data totally eclipses that released in the recent 'Collections' data leaks as reported by IT Pro earlier this year.
Citrix also has clients in Europe, including multi-national law firms which should set GDPR red flag alarms ringing. While the investigation is still in its infancy, there is the possibility, with a stolen dataset this large, that some of the data could belong to EU citizens which could mean a substantial fine could be levied at Citrix if it was found to have breached data security and breach management and reporting rules enshrined in GDPR.
Industry: Cyber Security News
- SailPoint File Access Manager Consultant/ Architect
- discussed on applications
SailPoint File Access Manager (SailPoint FAM) Consultant/ Architect is required for an up coming projects, Ideally looking for someone with experience in Designing and deploying SailPoint FAM , this is a new Deployment, you will work with customer in the initial workshop phase, to understand requirements and to get the initial design, you will then be responsible for deploying the solution. This is a home based role, with some onsite visits required during the length of the project. We are looking for someone who has previous experience in Deploying SailPoint FAM (ideally done design work) Need to have experience with SharePoint and ideally Azure and Share file
- Outside IR35 Contract- SC / DV - Cloud / VMware Solution Architect
- Outside IR35
Solution Architect Contract - with active Security Clearance needed for Outside IR35 Contract London. SC / DV (must be willing to undergo DV) 6 month rolling Immediate Experience delivering technical Security Architecture design / assurance of security design. Specific experience with Cloud and VMWARE technologies Cross domain experience desirable HLD / LLD Current SC Clearance a must. London 3 days a week Immediately interviewing.
- Contract Night Shift Senior SOC Analyst | Microsoft Defender | Outside IR35
- United Kingdom
- Outside IR35
Contract Night Shift Senior SOC Analyst | Microsoft Defender / Sentinel | Outside IR35 Looking for an experienced SOC analyst to cover a night shift SOC operation. Level 2 technical Analyst. You must have current hands on technical experience with Microsoft defender / Sentinel within a customer facing SOC environment. This is a UK based position.
- DV Cleared CyberArk Consultant- Contract
- City of London
- Upto £700 per day
CyberArk Consultant is needed to be responsible for leading the deployment of CyberArk solutions for this Secure government site You will work with customer, helping to create CyberArk Strategic Roadmaps, on-boarding accounts, product and process integration into the CyberArk Solution and Proviso of Installation and technical Documentation. We are looking for this individual to have experience in: In CyberArk deployment, and ideally leady the deployment both strategically and also technically for this project we need the consultant to hold current DV cleared status For the right individual this could be a long term project.