Boeing Distribution breached by LockBit via Citrix Bleed session hijacking
Boeing confirmed on November 1, 2023 a cyber incident affecting elements of its parts and distribution business, after LockBit appeared to claim credit. A joint CISA, FBI, MS-ISAC and ACSC advisory on November 21, 2023 stated Boeing observed LockBit 3.0 affiliates exploiting Citrix Bleed (CVE-2023-4966) to gain initial access to Boeing Distribution Inc. The flaw let attackers read valid NetScaler session tokens from memory and hijack authenticated sessions without a password or MFA.
- Victim
- Boeing
- Industry
- Manufacturing
- Country
- United States
- Intrusion began
- Oct 2023
- First disclosed
- Nov 1, 2023
- Actor
- LockBit 3.0 affiliate (Extortion group)
- Initial access
- Identity infrastructure vulnerability
- Identity control that failed
- Session and tokens
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
A session token copied from an appliance's memory is a full login. After patching, every NetScaler session had to be killed, because patching alone left already-stolen tokens valid.
Go deeper on SWI
- Technique: Token replay against an unbound endpoint
- Technique: Session cookie theft
- Vulnerability: Citrix Bleed, session-token leak from NetScaler ADC
Sources
- #StopRansomware: LockBit 3.0 ransomware affiliates exploit CVE 2023-4966 Citrix Bleed vulnerability (AA23-325A), CISA, Nov 21, 2023
- Boeing admits cyberattack on parts and distribution biz, The Register, Nov 2, 2023
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- MITRE NERVE network breached via Ivanti zero-days and session hijacking 2024 · Identity infrastructure vulnerability
- Comcast Xfinity customer data theft via Citrix Bleed 2023 · Identity infrastructure vulnerability
- GlobalProtect authentication bypass used as a ransomware front door 2026 · Identity infrastructure vulnerability
- Stolen Microsoft 365 session tokens replayed into 79 organizations 2026 · Phishing (adversary-in-the-middle)
Cite this record
SWI Community Team. (2026). Boeing Distribution breached by LockBit via Citrix Bleed session hijacking. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2023-boeing-citrix-bleed-lockbit/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.