Iran TerrorismCyberattack on Software Giant Citrix Attributed to Iranian Hackers

Cyberattack on Software Giant Citrix Attributed to Iranian Hackers

-

Cyberattack on Software Giant Citrix

By Mehdi

On March 6th Citrix was informed by the FBI that its systems had been breached by “international cyber criminals.” Last Friday, the company revealed that its internal network had been breached and the attackers may have stolen business documents.

Citrix has launched a forensic investigation and it has taken action to secure its network. So far, the investigation suggests that the business documents were accessed and downloaded, but has yet to determine exactly which documents might have been stolen.

The company claims that there is no evidence that the attack compromised the security of its products or services.

Citrix CISO Stan Black stated, “While not confirmed, the FBI has advised that the hackers likely used a tactic known as password spraying, a technique that exploits weak passwords. Once they gained a foothold with limited access, they worked to circumvent additional layers of security.”

Resecurity, a cybersecurity firm, claims that the attack was carried out by the Iran-linked group IRIDIUM, reported to have hit over 200 organizations, including government agencies, tech firms, and oil and gas companies. In a blog post, Resecurity said that it had alerted Citrix of an attack on December 28th. They believe that at least 6 terabytes of data were stolen from Citrix, including emails and files associated with project management and procurement.

“The incident has been identified as a part of a sophisticated cyberespionage campaign supported by nation-state due to strong targeting on government, military-industrial complex, energy companies, financial institutions and large enterprises involved in critical areas of economy,” Resecurity said in a blog post. “The arsenal of IRIDIUM includes proprietary techniques allowing to bypass 2FA authorization for critical applications and services for further unauthorized access to VPN (Virtual Private Networks) channels and SSO (Single Sign-On),” the firm added.

Representatives of Resecurity told NBC News that the attackers may have been lurking inside Citrix’s network for the past 10 years.

The Wall Street Journal recently ran an article on attacks carried out by Iranian hackers. It cited Resecurity saying that Citrix had been hit by Iranian hackers. However, a statement that Citrix provided to WSJ claimed that a single employee account was compromised in 2018 and that the hacker only gained access to an old version of a list containing Citrix employee contact information. Citrix also claimed that it had found no evidence that any other accounts had been compromised or that the attack may have been the work of a state-sponsored actor.

Resecurity’s claims that Iran was behind the attack have also been called into question by cybersecurity experts.

Regarding the recent attack on Australia’s political parties and parliament, Resecurity stated that is was the work of Iranian hackers. The Australian government has not accused anyone, but it did say the attack was apparently carried out by a “sophisticated state actor.” Sources close to the investigation told The Sydney Morning Herald that the prime suspect was actually China.

While Kaspersky Lab’s Costin Raiu pointed out inconsistencies in Resecurity’s claims — like the hackers having access to Citrix systems for the past ten years — he also told NBC News that Citrix came under attack twice, once in December and “again on Monday.”

In 2015 Citrix had a breach, but the company claimed that no customer or corporate data had been accessed by the hacker.

Latest news

 Statistics show that New Year accidents’ deaths in Iran reached 585

Ahmad Shirani, the head of the Information and Traffic Control Center of the Iranian regime’s police, announced that the...

Land Subsidence in Critical Conditions in Isfahan

Mehdi Toghyani, a member of the Iranian regime’s Majlis (parliament), pointed to the occurrence of land subsidence in various...

Iran’s Actual Inflation Rate Higher Than Official Stats

The state-run Donya-e-eqtesad newspaper, in a report analyzing the "general sentiment" regarding inflation in 2023, has stated that households...

Iranian Workers’ Monthly $136 Wages Can’t Cover $500 Expenses

The lives of a significant portion of the Iranian population are marked by uncertainty, largely because the Iranian economy...

Iranian Nurses Earn Twice Their Wages in Ride-Hailing Services

Reza Aryanpour, a member of the regime’s Majlis (parliament) Health and Treatment Commission, highlighted the growing trend of nurses...

Iran: Unprecedented Record of 152 Million Liters of Gasoline Consumption Per Day

On March 19, Iran set a new historical record in gasoline consumption with 152 million liters consumed in one...

Must read

Top cleric says Iran will not heed Security Council demand

Iran Focus: Tehran, Iran, Apr. 28 – Iran’s former...

New probe in death of Iranian-Canadian

AP: Iran's Supreme Court has ordered a new investigation...

You might also likeRELATED
Recommended to you