Story image

Was Citrix unaware of its own data breach until the FBI got involved?

14 Mar 2019

Technology giant Citrix found out about a breach in its internal network due to a tipoff from the FBI, the company says.

According to a blog post from Citrix’s CSIO Stan Black, the FBI contacted Citrix on March 6 and advised that international cybercriminals had allegedly gained access to Citrix’s internal network.

The FBI believes that the criminals most likely used a technique called ‘password spraying’, which is a kind of brute force attack that takes advantage of weak passwords. Once the criminals got in, they began moving further into the network.

“While our investigation is ongoing, based on what we know to date, it appears that the hackers may have accessed and downloaded business documents,” says Black.

“The specific documents that may have been accessed, however, are currently unknown. At this time, there is no indication that the security of any Citrix product or service was compromised.”

Once Citrix was alerted to the breach, it then contained the incident and took ‘actions to secure’ its internal network.

Forensic investigations and consultants from a cybersecurity firm were called in to help. Citrix says it continues to cooperate with the FBI.

According to cybersecurity firm Resecurity, the attack is linked to Iranian group IRIDIUM, which also conducted a number of attacks on other companies including government agencies, tech companies, and oil and gas companies.

The company posted a blog in which it outlines how the attacks likely occurred around October 15, 2018. Resecurity acquired the Global Access List related to the breach and found 31,378 records. 

“The threat actors leveraged it for further reconnaissance and accounts compromise,” the blog states.

In December 2018, Resecurity claims that it contacted Citrix to warn the company about a targeted attack and breach.

“Based our recent analysis, the threat actors leveraged a combination of tools, techniques and procedures (TTPs) allowing them to conduct a targeted network intrusion to access at least 6 terabytes of sensitive data stored in the Citrix enterprise network, including e-mail correspondence, files in network shares and other services used for project management and procurement.”

Citrix says it will have a better picture of the breach once it has what it believes is ‘credible and actionable information’.

“Citrix is moving as quickly as possible, with the understanding that these investigations are complex, dynamic and require time to conduct properly… details matter,” says Black.

“Citrix deeply regrets the impact this incident may have on affected customers. Citrix is committed to updating customers with more information as the investigation proceeds, and to continuing to work with the relevant law enforcement authorities.”

Privacy: The real cost of “free” mobile apps
Sales of location targeted advertising, based on location data provided by apps, is set to reach $30 billion by 2020.
Forrester names Crowdstrike leader in incident response
The report provides an in-depth evaluation of the top 15 IR service providers across 11 criteria.
Norwegian aluminium manufacturer hit hard by LockerGoga ransomware attack
“IT systems in most business areas are impacted and Hydro is switching to manual operations as far as possible.”
Slack doubles down on enterprise key management
EKM adds an extra layer of protection so customers can share conversations, files, and data while still meeting their own risk mitigation requirements.
Security professionals want to return fire – Venafi
Seventy-two percent of professionals surveyed believe nation-states have the right to ‘hack back’ cybercriminals.
Alcatraz AI to replace corporate badges with AI security
The Palo Alto-based startup supposedly leverages facial recognition, 3D sensing, and machine learning to enable secure access control.
Unencrypted Gearbest database leaves over 1.5mil shoppers’ records exposed
Depending on the countries and information requirements, the data could give hackers access to online government portals, banking apps, and health insurance records.
Mozilla launches Firefox Send, an encrypted file transfer service
Mozille Firefox has launched a free encrypted file transfer service that allows people to securely share files from any web browser – not just Firefox.