CasesS=1:500S=1:100
Boeing ransomware attack (2023): how LockBit got in
A flaw in the NetScaler remote-access gateway let the attackers take over valid sessions, so neither the password nor multi-factor authentication was checked again.
1 Summary
By late October 2023, when LockBit listed Boeing on its leak site, ransomware actors had broken into Boeing's parts and distribution business. Boeing called it a cyber incident that does not affect flight safety. A joint US and Australian advisory, drawing on what Boeing shared, says the initial access came through CVE-2023-4966 (Citrix Bleed) in NetScaler.
Probable cause: A flaw in the NetScaler remote-access gateway let the attackers take over valid sessions, so neither the password nor multi-factor authentication was checked again.
Source: CISA, FBI, MS-ISAC, ASD's ACSC #StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability (AA23-325A)
The opening is Citrix NetScaler ADC / Gateway, the remote-access gateway that chapter 3 lists among the doors.
S=1:100 2 Factual information
2.1 The way in
Joint advisory AA23-325A, built partly on information Boeing shared: "Boeing observed LockBit 3.0 affiliates exploiting CVE-2023-4966, to obtain initial access to Boeing Distribution Inc."
Source: CISA, FBI, MS-ISAC, ASD's ACSC #StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability (AA23-325A)
- Product
- Citrix NetScaler ADC / Gateway
- CVE
- CVE-2023-4966
2.2 After entry
Per the advisory, the attackers hijacked legitimate sessions, harvested credentials, moved laterally, and used remote-management tools and scripts.
2.3 Damage
Boeing said elements of its parts and distribution business were affected and that flight safety was not.
2.4 Sequence of events
| Time | Actor | Event | Source |
|---|---|---|---|
| c. 2023-10 | Intruder | LockBit 3.0 affiliates gain initial access through CVE-2023-4966; date not stated. | CISA, FBI, MS-ISAC, ASD's ACSC |
| 2023-11-02 | Boeing | Confirms a cyber incident to the press; says flight safety is not affected. | TechCrunch |
| 2023-11-21 | CISA and partners | Joint advisory AA23-325A published. | CISA, FBI, MS-ISAC, ASD's ACSC |
S=1:100 3 Analysis
| Point | Finding | Source |
|---|---|---|
| Initial access was through CVE-2023-4966 in NetScaler ADC / Gateway. | Stated | CISA, FBI, MS-ISAC, ASD's ACSC |
| The flaw lets attackers bypass passwords and multi-factor authentication by hijacking legitimate sessions. | Stated | CISA, FBI, MS-ISAC, ASD's ACSC |
S=1:100 4 Conclusions
The advisory states that LockBit 3.0 affiliates gained initial access to Boeing Distribution Inc. through CVE-2023-4966, and uses the case to describe how the flaw lets attackers skip authentication.
S=1:100 5 Recommendations
Recommended or carried out by: CISA, FBI, MS-ISAC, ASD's ACSC
- Isolate NetScaler appliances until they are updated.
- Upgrade to a fixed version.
- Hunt for signs of compromise.
- Rotate credentials.
Source: CISA, FBI, MS-ISAC, ASD's ACSC #StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability (AA23-325A)
Sources
Source: CISA, FBI, MS-ISAC, ASD's ACSC #StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability (AA23-325A)TechCrunch 「Boeing confirms ‘cyber incident’ after ransomware gang claims data theft」