Citrix security breach sees 6TB of sensitive data stolen

Resecurity attributed the attack to Iranian hacking group IRIDIUM

Data breach

Citrix has suffered a cyber attack that resulted in the loss of 6TB worth of data including emails, blueprints and other business documents.

In an official but brief statement, Stan Black, Citrix CISO, said that the Federal Bureau of Investigation (FBI) had alerted the company to the possibility that its systems had been compromised in the middle of last week.

Advertisement - Article continues below

In Citrix's initial statement, it was only understood that its systems had been compromised and documents may have been stolen. It wasn't until cyber security firm Resecurity released a statement regarding the extent of the damage and who was behind it.

Resecurity claimed to have first alerted Citrix to early warning signs of a data breach back on 28 December 2018 and since then, continued to present its findings to the FBI and Citrix, which has clients including businesses, the American military and government departments.

"Citrix has taken action to contain this incident," it said in the statement. "We commenced a forensic investigation; engaged a leading cyber security firm to assist; took actions to secure our internal network; and continue to cooperate with the FBI."

"Citrix is moving as quickly as possible, with the understanding that these investigations are complex, dynamic and require time to conduct properly. In investigations of cyber incidents, the details matter, and we are committed to communicating appropriately when we have what we believe is credible and actionable information.

Advertisement - Article continues below
Advertisement - Article continues below

"While our investigation is ongoing, based on what we know to date, it appears that the hackers may have accessed and downloaded business documents. The specific documents that may have been accessed, however, are currently unknown. At this time, there is no indication that the security of any Citrix product or service was compromised."

Resecurity attributed the attack to the Iranian hacking group IRIDIUM which, according to Citrix, used a password spraying technique to establish an initial foothold before circumventing further security layers.

Password spraying is slightly different from a brute force attack which involves targeting a single account and launching a barrage of different passwords at it, in the hope of one unlocking the account. Password spraying targets many accounts by throwing commonly used passwords their way to see if any of them work.

"The incident has been identified as a part of a sophisticated cyber espionage campaign supported by nation-state due to strong targeting on government, military-industrial complex, energy companies, financial institutions and large enterprises involved in critical areas of economy," read the blog post from Resecurity.

Advertisement - Article continues below

"Based our recent analysis, the threat actors leveraged a combination of tools, techniques and procedures (TTPs) allowing them to conduct targeted network intrusion to access at least 6 terabytes of sensitive data stored in the Citrix enterprise network, including e-mail correspondence, files in network shares and other services used for project management and procurement.

"The arsenal of IRIDIUM includes proprietary techniques allowing to bypass 2FA authorisation for critical applications and services for further unauthorized access to VPN (Virtual Private Networks) channels and SSO (Single Sign-On)."

The investigation is in the early stages of progression but Citrix has vowed to remain compliant with the FBI and to provide its customers with regular updates on the case.

A wider view

There is speculation around whether the attack originated from Iranian sources at all. Resecurity had previously attributed the attack on the Australian government's computers to state-backed IRIDIUM. However, sources close to the case had said that the attack seemed to have been at the hands of China, or a group posing as the Chinese perhaps.

Advertisement - Article continues below

However, Microsoft last week also spoke out against Iranian-linked hackers. Speaking to the Wall Street Journal, the tech giant said Iranian hackers had targeted 'hundreds of thousands of people at more than 200 companies over the past two years.

When we see data breaches reported near-daily, it's easy to become desensitised to the stories, but let's not undermine the significance of a breach this large. 6TB of data is a mammoth amount especially for a company with such high-profile clients as Citrix. The amount of data totally eclipses that released in the recent 'Collections' data leaks as reported by IT Pro earlier this year.

Citrix also has clients in Europe, including multi-national law firms which should set GDPR red flag alarms ringing. While the investigation is still in its infancy, there is the possibility, with a stolen dataset this large, that some of the data could belong to EU citizens which could mean a substantial fine could be levied at Citrix if it was found to have breached data security and breach management and reporting rules enshrined in GDPR.

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now


cyber security

Report: 16.5 million Britons fell victim to cyber crime in the past year

1 Apr 2020
Amazon Web Services (AWS)

AWS launches Amazon Detective for investigating security incidents

1 Apr 2020

UK government to launch coronavirus 'contact tracking' app

1 Apr 2020
video conferencing

Zoom admits meetings don't use end-to-end encryption

1 Apr 2020

Most Popular

cyber crime

FBI warns of ‘Zoom-bombing’ hackers amid coronavirus usage spike

31 Mar 2020
data breaches

Marriott data breach exposes personal data of 5.2 million guests

31 Mar 2020
application programming interface (API)

Apple buys Dark Sky weather app and leaves Android users in the cold

1 Apr 2020
data management

Oracle cloud courses are free during coronavirus lockdown

31 Mar 2020