Hackers are hiding on 39 Dutch servers after they have entered through a leak in software from the American company Citrix, according to research by security company Fox-IT. The major leak was discovered in late 2019, after which the company took steps to shut down vulnerable access. However, hackers have managed to penetrate, for example because the vulnerability has not been remedied by the server administrator or has been remedied too late.
The company cannot say how many Dutch organizations belong to the 39 Dutch servers identified by Fox-IT. It is possible that a large company uses multiple Citrix servers, or that a foreign company uses Dutch servers.
According to de Volkskrant The hackers are still in the systems of at least 25 Dutch organizations, although they have now removed the Citrix vulnerability. Thirty Dutch organizations would not have plugged the leak, the newspaper writes, leaving the door open to hackers.
Fox-IT writes that at least 3,332 servers have been hacked worldwide, almost half of which are from the United States. In nearly a quarter (23 percent) of cases, the Citrix vulnerability has been formally remedied with an update, but traces have been found that show that hackers had previously accessed the server.
Among the 25 organizations that according to de Volkskrant in that situation is, among other things, a company that makes watermarks for banknotes, according to the daily. Hackers would also be hiding on the servers of a pharmaceutical company and a disability care organization.
The leak in the Citrix software received a lot of attention in early 2020 after the magnitude of the risks became visible. Hackers can use the access to the server for sabotage, among other things. Attackers turned out to be actively exploiting the open door in the software to penetrate. This happened, among others, at the Medical Center Leeuwarden.
– .
