In recent developments, major organisations, including the renowned aviation company Boeing, have fallen victim to sophisticated cyberattacks. Central to these breaches is a vulnerability in Citrix software, now infamously known as “Citrix Bleed.”
This security flaw was exploited by the notorious ransomware group LockBit 3.0, renowned for its aggressive cyber activities.
Despite efforts by Citrix to patch the vulnerability, LockBit 3.0, a group originating from Russia, successfully launched an attack on Boeing last month. The situation escalated when the group published approximately 50GB of data purportedly extracted from Boeing’s systems.
This year alone, LockBit 3.0’s activities have impacted over 800 organisations worldwide. Boeing, in a public statement, acknowledged the breach and affirmed their ongoing investigations in collaboration with law enforcement and regulatory bodies. They emphasised their commitment to addressing the security concerns and supporting all affected stakeholders. Shockingly, U.S. organisations have reportedly paid a staggering $90 million in ransoms to LockBit since 2020. This alarming figure underscores the group’s prowess and the severity of their operations.
In a proactive response, the Cybersecurity and Infrastructure Security Agency (CISA), along with the FBI and the Australian Cyber Security Center, issued an advisory based on Boeing’s shared data. The advisory detailed how LockBit 3.0 could bypass password protections and multi-factor authentication (MFA) through Citrix Bleed, enabling them to hijack legitimate user sessions. Citrix’s prompt patch release, although crucial, came after the vulnerability had been exploited. CISA’s advisory was an urgent call to action for organisations using affected Citrix software to update their systems immediately. This was crucial to prevent session takeovers that could lead to data breaches and unauthorised access to sensitive information.
Adding to the concern, CISA has alerted around 300 organisations about the vulnerability, urging them to fortify their defences. LockBit 3.0’s reach extends beyond Boeing, with attacks on major entities like the Industrial & Commercial Bank of China (ICBC), international law firm Allen & Overy, and the UK’s Royal Mail.
The attack on ICBC’s U.S. operations was particularly disruptive, leading to significant impacts in U.S. Treasury markets. These incidents serve as a stern reminder of the importance of timely software updates and robust cybersecurity measures.
In light of these events, we strongly recommend considering a migration to Azure Virtual Desktop for enhanced security and support. Techn22 specialise in Azure Virtual Desktop and compliments this with an array of additional Cyber Security tools, designed to protect your business and users.
