COI Report – Part III
Page
66 of
425 188. On 26 June 2018, the attacker remotely logged-in to Citrix Server 2 from Workstation Busing the SA. account. From Citrix Server 2, the attacker used the DA. account to
access a H-Cloud Citrix server, Citrix Server 3. While there is no conclusive evidence to show this, CSA assesses that it is probable that whilst logged into Citrix Server 3, the attacker stole credentials to an account referred to in this report as the “
A.A. account”. Obtaining the credentials to the AA. account allowed the attacker to cross the
last-mile to the SCM server, as it could be used to make SQL queries to the database.
189. CSA’s assessment is that there was a coding vulnerability in the SCM application, and it is highly probable that this vulnerability allowed the attacker to easily retrieve the credentials of the AA. account. Further details of this vulnerability will be discussed in section 15.6 (pg 86) below.
190. The lateral movement to Citrix Server 3 was significant because credentials of the AA. account could not be obtained from the SGH Citrix Servers 1 and 2. This arose from the fact that the SGH servers were no longer being used actively to connect to the SCM database following the migration of the SCM application to H-Cloud Citrix servers in July 2017.
191. Lum has explained that connectivity between Citrix Server 2,
which was an SGH server, and Citrix Server 3, a H-Cloud server,
was present since June 2017 when the SCM system was migrated to the H-Cloud. The plan was to have all Citrix servers in both SGH and the H-Cloud form one logical farm, and the planned upgrade was scheduled for completion in September 2018. Only the ports that were required for the Citrix servers to communicate were left open. It was through this connection that the attacker was able to connect from Citrix Server 2 to Citrix Server 3.
192. With the credentials to the AA. account, the attacker began the Actions on Objectives phase as described
in the Cyber Kill Chain, retrieving and exfiltrating patient data from the SCM database.
Share with your friends: 
