CASE DOSSIER alleged

Boeing Commercial Airplanes Parts Supply Extortion

Docket: SEC Form 8-K Disclosure Court: U.S. District Court for the Eastern District of Virginia Opened: 2023-11-02 Sector: Aerospace, Defense & Manufacturing

Key Facts

Status

ALLEGED

Legal disposition

Loss Amount

$60.0 million

Distribution disruption, internal remediation, and third-party supplier forensic audits.

Techniques

Verified mappings

Defendants

Named in charges

Legal Status: ALLEGED in U.S. District Court for the Eastern District of Virginia.
Primary Target Sector: Aerospace, Defense & Manufacturing.
Documented Financial Loss: $60.0 million.
3 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.

Export structured case data and MITRE ATT&CK Navigator layer:

Download Navigator Layer (JSON) Case Data (JSON)

Case Summary

LockBit ransomware affiliates exploited the Citrix Bleed zero-day (CVE-2023-4966) to bypass multi-factor authentication, exfiltrating 43 gigabytes of sensitive internal aerospace data and parts distribution documentation from Boeing parts and distribution business.

BOARDROOM EXECUTIVE BRIEF

Executive Summary for Board Members & Leadership

Plain-English Root Cause

Exploitation of the CitrixBleed vulnerability (CVE-2023-4966) on an internet-facing Citrix NetScaler ADC gateway, enabling unauthenticated remote attackers to dump memory and hijack valid enterprise user sessions.

Operational & Financial Fallout

LockBit ransomware group exfiltrated approximately 43 gigabytes of internal parts distribution, aerospace supplier, and technical documents, publishing the entire archive on their Tor leak site after Boeing refused to pay the extortion demand.

3 Critical Boardroom Questions

1. Do 100% of our external portals enforce phishing-resistant hardware MFA?
2. Can compromised endpoint credentials traverse laterally to domain controllers or cloud storage?
3. Have our air-gapped immutable recovery backups been restored and tested within the last 90 days?

Disposition: ALLEGED

Technical Threat Intelligence

Attack Anatomy & Incident Execution

Forensic analysis of initial intrusion vector, step-by-step kill chain, operational blast radius, and defensive controls.

Ground Zero / Infiltration Vector

Adversary Kill Chain Flow

5 Documented Phases

Initial Access CitrixBleed Session Hijack Ingress (CVE-2023-4966)

MITRE ATT&CK T1190 →

Attackers exploited CVE-2023-4966 buffer overflow on NetScaler gateways to extract session cookies from memory, bypassing multifactor authentication.

Artifacts & Tooling: CVE-2023-4966 exploit Hijacked NetScaler session cookie

Discovery Host Reconnaissance & Network Discovery

MITRE ATT&CK T1087 →

Threat actors used PowerShell and standard Windows utilities to map internal networks and identify file servers supporting commercial parts distribution.

Artifacts & Tooling: PowerShell discovery scripts Network share enumeration

Collection Sensitive Document Harvesting

MITRE ATT&CK T1005 →

Operatives collected internal engineering documents, supplier invoices, and parts distribution logs into compressed staging folders.

Artifacts & Tooling: Aggregated technical PDFs Supplier invoice databases

Exfiltration Cloud Storage Exfiltration via Rclone

MITRE ATT&CK T1567.002 →

Using command-line cloud transfer tools (Rclone), the attackers exfiltrated the 43 GB data repository to external cloud storage providers.

Artifacts & Tooling: Rclone configuration Cloud storage outbound streams

Extortion Impact Extortion Shaming & Public Leak

MITRE ATT&CK T1651 →

Following non-payment of extortion demands, LockBit released the exfiltrated archives on their dark web leak portal.

Artifacts & Tooling: LockBit Tor leak publication Extortion ransom communication

Real-World Blast Radius & Operational Fallout

Defensive Engineering Takeaways

Recommended Hardening Controls

✓ Rapidly apply vendor security updates for public-facing edge appliances and terminate all active sessions post-patching.

✓ Implement behavioral anomaly detection on edge VPN and ADC gateways to detect session cookie reuse from novel IP addresses.

✓ Block unauthorized egress connections to public cloud storage and file-sharing infrastructure.

✓ Maintain strict access control lists on commercial parts distribution and supplier document repositories.

Procedural & Incident Timeline

2023-10-25 incident

LockBit affiliates compromise Boeing parts and distribution portal via unpatched Citrix gateway.

2023-11-02 disclosure

Boeing confirms cyber incident impacting its parts business.

2023-11-10 extortion

LockBit syndicate publishes 43GB of stolen data after Boeing refuses extortion payment.

Substantiated MITRE ATT&CK Techniques

Technique ID	Technique Name & Tactic	Primary Source Evidence Excerpt	Locator	Verification
T1190	Exploit Public-Facing Application Initial Access	"Ransomware affiliates leveraged Citrix Bleed (CVE-2023-4966) to extract active user session tokens from NetScaler appliance memory, hijacking authenticated sessions without entering MFA codes."	CISA Advisory AA23-325A: LockBit 3.0 Ransomware Affiliates Exploit CVE-2023-4966	reviewed
T1539		"Stolen session cookies were injected directly into HTTP request headers to access internal Boeing parts portal web applications."	FBI Flash Report on Citrix Bleed Exploitation	reviewed
T1567	Exfiltration Over Web Service Exfiltration	"Threat actors transferred approximately 43GB of backup archives, financial spreadsheets, and engineering vendor lists to LockBit extortion infrastructure."	DOJ Indictment: U.S. v. Khoroshev	reviewed

Cite & Embed This Case Record

Public Domain / CC0

Bluebook Legal Citation:

Cyberattack Case Library, Boeing Commercial Airplanes Parts Supply Extortion, No. SEC Form 8-K Disclosure (U.S. District Court for the Eastern District of Virginia 2023), https://cybercaselibrary.com/cases/boeing-lockbit-citrixbleed-ransomware/

Embeddable Incident Card (HTML):