Pierluigi Paganini November 13, 2023

The LockBit ransomware group published data allegedly stolen from the aerospace giant Boeing in a recent attack.

The Boeing Company, commonly known as Boeing, is one of the world’s largest aerospace manufacturers and defense contractors.

 In 2022, Boeing recorded $66.61 billion in sales, the aerospace giant has 156,000 (2022).

At the end of October, the Lockbit ransomware group added Boeing to the list of victims on its Tor leak site. The gang claims to have stolen a huge amount of sensitive data from the company and threatens to publish it if Boeing does not contact them within the initial deadline (02 Nov, 2023 13:25:39 UTC, later postponed to 10 Nov, 2023).

In early November 2023, the company confirmed that its services division was hit by a cyber attack, it also added that the investigation is still ongoing. The attack targeted elements of the parts and distribution business run by its global services division.

Boeing notifies law enforcement agencies and relevant regulatory authorities.

“We are actively investigating the incident and coordinating with law enforcement and regulatory authorities.” reads the statement released by the aerospace giant. “A cyber gang with Russian ties, known as Lockbit, claimed in a post on the dark web last week that it would start releasing “sensitive data” if the aerospace and defense giant didn’t meet a ransom demand by Nov. 2. But on Wednesday evening, there was no mention of Boeing on Lockbit’s leak website.”

Boeing refused to pay the ransom and the LockBit group leaked more than 40GB of files from Boeing.

Bleeping Computer analyzed the leaked data and reported that most of the published data are backups for various systems. Most recent documents in the leaked data are dated back to October 22.

At this time, it’s unclear how threat actors have breached the company. Some experts speculate attackers may have carried out the ‘Citrix Bleed‘ attack to breach the company.

In October, Citrix urged administrators to secure all NetScaler ADC and Gateway appliances against the CVE-2023-4966 vulnerability, which is actively exploited in attacks.

On October 10, Citrix published a security bulletin related to a critical vulnerability, tracked as CVE-2023-4966, in Citrix NetScaler ADC/Gateway devices.

Researchers from Mandiant observed the exploitation of this vulnerability as a zero-day since late August.

Threat actors exploited this vulnerability to hijack existing authenticated sessions and bypass multifactor authentication or other strong authentication requirements. The researchers warn that these sessions may persist after the update to mitigate CVE-2023-4966 has been deployed. 

Mandiant also observed threat actors hijacking sessions where session data was stolen prior to the patch deployment and subsequently used by the threat actor. 

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, North Korea)