Nearly 50GB of Boeing Data Leaked by LockBit

Following Boeing's succumbing to the LockBit ransomware group's target. The attackers, known for their resilience in the ransomware-as-a-service domain, have reportedly leaked around 50 GB of files.

Timeline Unveiled

LockBit initially warned Boeing of the impending data leak in late October, citing the company's alleged disregard for their threats. After Boeing failed to comply, LockBit carried out their ultimatum and released over 43GB of data on November 10. The leaked files, primarily backups, included configurations for IT management software, logs for monitoring tools, and data from Citrix appliances.

LockBit Modus Operandi

LockBit's strategy involves exfiltrating sensitive data and demanding ransom payments. The group has a history of targeting high-profile entities, including Continental, the UK Royal Mail, and the Italian Internal Revenue Service. The U.S. government revealed in June that LockBit extorted around $91 million since 2020 through nearly 1,700 attacks.

Boeing's Response and Acknowledgment

Boeing, a major player in the aerospace and defense sectors, confirmed the cyberattack but remained tight-lipped about the specifics. The company neither disclosed the breach details nor how the hackers infiltrated their network. The lack of transparency from Boeing has left the cybersecurity community grappling with unanswered questions.

Extortion Campaign

LockBit's release of the first batch of data appears to be part of an extortion campaign. The leaked information includes sensitive company data, such as engine part suppliers, technical operators, financial records, and marketing data. Boeing, in response, stated that the cyber incident only affected elements of their parts and distribution business, assuring that flight safety remained unaffected.

What Was in the Leaked Data?

The leaked data provides a glimpse into Boeing's internal operations, encompassing training materials, technical supplier lists, and strategic documents. Notably, the information includes names, locations, and contact details of Boeing's suppliers and distributors across Europe and North America. Some of the leaked data dates back to 2019, indicating a potentially prolonged infiltration.

The Technical Angle: Citrix Bleed Vulnerability

Speculation arose about LockBit exploiting the recently disclosed Citrix Bleed vulnerability (CVE-2023-4966). This vulnerability, for which proof-of-concept exploit code was published on October 24, targets Citrix appliances. The inclusion of Citrix appliance backups in the leaked data suggests a potential avenue of entry for LockBit.

Boeing's Dilemma and the Industry Impact

Boeing now faces the daunting task of mitigating the fallout from this cybersecurity breach. The exposure of strategic documents, financial details, and supplier information poses not only reputational risks but also operational challenges. The aerospace giant must reassess its cybersecurity measures to prevent future incidents.

The International Scale of LockBit's Operations

LockBit's reach extends beyond national borders, as evidenced by the Spanish National Police's warning of a phishing campaign in August targeting architecture firms. The group's adaptability and resilience make them a formidable threat on the global stage.

The Urgent Need for Heightened Cybersecurity Measures

Boeing's breach serves as a stark reminder of the persistent threat posed by ransomware attacks. Organizations, especially those in critical industries, must prioritize cybersecurity measures to safeguard sensitive information and maintain operational integrity.