Boeing LockBit ransomware via Citrix Bleed (2023)

In late October 2023, the LockBit ransomware operation announced it had stolen "a tremendous amount" of data from Boeing and would publish it unless the aerospace giant paid by 2 November. Boeing confirmed an incident affecting its parts and distribution business on 2 November and declined to pay. On 10 November, LockBit released approximately 45 GB of Boeing data publicly. Analysis of the leak indicated the attackers had exploited the Citrix Bleed vulnerability (CVE-2023-4966) for initial access.

What happened

Boeing's parts and distribution business is the global infrastructure that handles spare-part orders, technical-supplier coordination, and the routine commercial flow of aerospace components. On 27 October 2023, LockBit posted a public claim threatening release of stolen Boeing data unless a ransom was paid by 2 November. Boeing confirmed it was responding to a cyber incident the same day the deadline passed and declined to negotiate.

On 10 November, LockBit released all the data it claimed to have — approximately 43–45 GB. The contents included:

• Citrix logs dated as recently as 22 October 2023.
• Email backups, provisioning service data.
• Audits and security-control documents.
• Boeing training materials.
• Lists of Boeing's technical suppliers and distributors across Europe and North America (names, locations, phone numbers).
• Boeing financial details including sales, rebates, cost of poor quality (COPQ) reports, and pricing data for 2020.

Researchers cross-referencing the leaked material against published vulnerability data concluded that LockBit likely exploited CVE-2023-4966 (Citrix Bleed) to gain initial access — the same flaw used in the contemporaneous ICBC attack.

Impact

• ~45 GB of Boeing data released publicly.
• Supplier and distributor contact data, internal pricing, and audit documents exposed.
• Boeing refused to pay — one of the highest-profile no-pay decisions in U.S. ransomware.
• Citrix Bleed (CVE-2023-4966) confirmed as the initial-access vector.

Why it matters

The Boeing case combines two firsts on a public scale: Citrix Bleed at industrial scale (also seen at ICBC) and a major U.S. defence-adjacent contractor publicly refusing to pay LockBit. The leak's content composition — supplier lists, pricing data, COPQ reports — also shows how thoroughly modern ransomware extortion harvests commercial intelligence from a target before the encryption stage.