LockBit Affiliates Used Citrix Bleed to Reach Boeing’s Parts Distribution Unit

Citrix published a patch for NetScaler ADC and NetScaler Gateway on 10 October 2023. The flaw, CVE-2023-4966, became known as Citrix Bleed. CISA subsequently issued guidance on active, targeted exploitation, and a joint advisory set out what LockBit 3.0 affiliates were doing with it.

CISA describes a vulnerability that leaks sensitive information from device memory, including session tokens, which an attacker can then use to hijack a session.

A session token is what an appliance issues after it has already decided who you are. An attacker holding one arrives after authentication rather than in front of it, which means multi-factor authentication is not bypassed — it is simply not consulted.

This is why resetting passwords was insufficient advice and why the mitigation required terminating existing sessions. Patching stops the leak; it does not invalidate what already leaked. The corpus filed the identical distinction at 25-0723, where a SharePoint chain stole machine keys that kept working after the update, and at 24-0110, where mitigation was explicitly not eviction.

The joint advisory carries technical detail contributed by the FBI, the Australian Cyber Security Centre and Boeing, following LockBit 3.0 affiliate activity against Boeing Distribution Inc., the company’s parts distribution business.

That is unusual enough to note. An affected organisation putting its own incident detail into a public advisory converts a private loss into a defence others can use, and the corpus records very few instances of it — the closest comparisons are the Nevada after-action reports filed at 25-0924 and 25-1107.

Reporting described exploitation attempts within hours of public disclosure, using published proof-of-concept code against exposed appliances. The corpus later put this in a single sentence at 25-1216: the patch cycle was designed around a window that no longer exists.