Citrix security breach sees 6TB of sensitive data stolen

Resecurity attributed the attack to Iranian hacking group IRIDIUM

Data breach

Citrix has suffered a cyber attack that resulted in the loss of 6TB worth of data including emails, blueprints and other business documents.

In an official but brief statement, Stan Black, Citrix CISO, said that the Federal Bureau of Investigation (FBI) had alerted the company to the possibility that its systems had been compromised in the middle of last week.

Advertisement - Article continues below

In Citrix's initial statement, it was only understood that its systems had been compromised and documents may have been stolen. It wasn't until cyber security firm Resecurity released a statement regarding the extent of the damage and who was behind it.

Resecurity claimed to have first alerted Citrix to early warning signs of a data breach back on 28 December 2018 and since then, continued to present its findings to the FBI and Citrix, which has clients including businesses, the American military and government departments.

"Citrix has taken action to contain this incident," it said in the statement. "We commenced a forensic investigation; engaged a leading cyber security firm to assist; took actions to secure our internal network; and continue to cooperate with the FBI."

"Citrix is moving as quickly as possible, with the understanding that these investigations are complex, dynamic and require time to conduct properly. In investigations of cyber incidents, the details matter, and we are committed to communicating appropriately when we have what we believe is credible and actionable information.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"While our investigation is ongoing, based on what we know to date, it appears that the hackers may have accessed and downloaded business documents. The specific documents that may have been accessed, however, are currently unknown. At this time, there is no indication that the security of any Citrix product or service was compromised."

Resecurity attributed the attack to the Iranian hacking group IRIDIUM which, according to Citrix, used a password spraying technique to establish an initial foothold before circumventing further security layers.

Password spraying is slightly different from a brute force attack which involves targeting a single account and launching a barrage of different passwords at it, in the hope of one unlocking the account. Password spraying targets many accounts by throwing commonly used passwords their way to see if any of them work.

"The incident has been identified as a part of a sophisticated cyber espionage campaign supported by nation-state due to strong targeting on government, military-industrial complex, energy companies, financial institutions and large enterprises involved in critical areas of economy," read the blog post from Resecurity.

Advertisement - Article continues below

"Based our recent analysis, the threat actors leveraged a combination of tools, techniques and procedures (TTPs) allowing them to conduct targeted network intrusion to access at least 6 terabytes of sensitive data stored in the Citrix enterprise network, including e-mail correspondence, files in network shares and other services used for project management and procurement.

"The arsenal of IRIDIUM includes proprietary techniques allowing to bypass 2FA authorisation for critical applications and services for further unauthorized access to VPN (Virtual Private Networks) channels and SSO (Single Sign-On)."

The investigation is in the early stages of progression but Citrix has vowed to remain compliant with the FBI and to provide its customers with regular updates on the case.

A wider view

There is speculation around whether the attack originated from Iranian sources at all. Resecurity had previously attributed the attack on the Australian government's computers to state-backed IRIDIUM. However, sources close to the case had said that the attack seemed to have been at the hands of China, or a group posing as the Chinese perhaps.

Advertisement - Article continues below

However, Microsoft last week also spoke out against Iranian-linked hackers. Speaking to the Wall Street Journal, the tech giant said Iranian hackers had targeted 'hundreds of thousands of people at more than 200 companies over the past two years.

When we see data breaches reported near-daily, it's easy to become desensitised to the stories, but let's not undermine the significance of a breach this large. 6TB of data is a mammoth amount especially for a company with such high-profile clients as Citrix. The amount of data totally eclipses that released in the recent 'Collections' data leaks as reported by IT Pro earlier this year.

Citrix also has clients in Europe, including multi-national law firms which should set GDPR red flag alarms ringing. While the investigation is still in its infancy, there is the possibility, with a stolen dataset this large, that some of the data could belong to EU citizens which could mean a substantial fine could be levied at Citrix if it was found to have breached data security and breach management and reporting rules enshrined in GDPR.

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Putting a spotlight on cyber security

An examination of the current cyber security landscape

Download now

The economics of infrastructure scalability

Find the most cost-effective and least risky way to scale

Download now

IT operations overload hinders digital transformation

Clearing the path towards a modernised system of agreement

Download now
Advertisement
Advertisement

Recommended

Visit/security/ransomware/356292/university-of-california-gets-fleeced-by-hackers-for-114-million
ransomware

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
Visit/security/cyber-security/356289/australia-announces-135b-investment-in-cybersecurity
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
Visit/cloud/cloud-security/356288/csa-and-issa-form-cybersecurity-partnership
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020
Visit/business/policy-legislation/356215/senators-propose-a-bill-aimed-at-ending-warrant-proof-encryption
Policy & legislation

Senators propose a bill aimed at ending warrant-proof encryption

24 Jun 2020

Most Popular

Visit/laptops/29190/how-to-find-ram-speed-size-and-type
Laptops

How to find RAM speed, size and type

24 Jun 2020
Visit/security/vulnerability/356295/microsoft-patches-high-risk-flaws-that-can-be-exploited-with-a
vulnerability

Microsoft releases urgent patch for high-risk Windows 10 flaws

1 Jul 2020
Visit/policy-legislation/data-protection/356344/eu-institutions-warned-against-purchasing-any-further
data protection

EU institutions told to avoid Microsoft software after licence spat

3 Jul 2020