Citrix was breached through password spraying
The FBI told Citrix attackers got in by trying common passwords against many accounts. Simple attack, simple defences.
Citrix said last week that the FBI informed it of attackers inside its network. The likely method, according to the FBI: password spraying. That means trying a few common passwords, like Spring2019!, against many usernames, slowly enough to avoid lockouts.
It works because in any large company, someone has a weak password, and some login page doesn’t require MFA.
Defences:
- MFA on every external login: email, VPN, remote desktop, web apps.
- Block legacy protocols that skip MFA.
- Ban common and breached passwords when people set them.
- Alert on failed logins across many accounts from the same source, not just many failures on one account.
Lockout policies alone don’t stop spraying. It’s designed to stay under them.