Infosec in brief On August 29, the US Federal Emergency Management Agency fired its CISO, CIO, and 22 other staff for incompetence but insisted it wasn't in response to an online attack. New material suggests FEMA's claim may be false. According to DHS Secretary Kristi Noem, an audit found serious security problems at FEMA and revealed that "entrenched bureaucrats" had lied about the agency's security preparedness. "These deep-state individuals were more interested in covering up their failures than in protecting the Homeland and American citizens' personal data, so I terminated them immediately," she said. Crucially, Noem said no data had been lost but it appears that's not the case. According to a presentation passed to Nextgov, attackers broke into FEMA in June using stolen credentials to access a Citrix system. The attackers then uploaded data from FEMA's Region 6 servers, covering Arkansas, Louisiana, New Mexico, Oklahoma, and Texas. According to the documents, FEMA didn't discover the attack until July. By July, the Cybersecurity and Infrastructure Security Agency was telling agencies to patch against so-called CitrixBleed 2 attacks that exploited a CVSS 9.3 bug in Netscaler's ADC and Gateway platforms that would allow miscreants to steal sensitive data such as session tokens and bypass multi-factor authentication. There were warnings that the bug was being exploited back in June, but it seems they weren't heeded. Now, it appears, FEMA's IT department is getting a compl...
AWS, Cloudflare, Google, helped Feds identify DDOS suspect
The Register
·Iain Thomson
·Published Aug 25, 2025
·Updated
Affected Software
1 affected component
Citrix Citrix system
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses actions taken by the US government in response to cybersecurity incidents, including the identification of a DDoS attack suspect by major tech companies.
2
What security implications are discussed?
The article implies that there may be a connection between FEMA's internal staffing issues and external cyber threats, challenging their public statements.
3
What products or software are affected?
The article specifically mentions the Citrix system as being relevant to the incidents discussed.
4
Who were the key players involved in identifying the DDoS suspect?
AWS, Cloudflare, and Google played crucial roles in assisting federal authorities in identifying the DDoS suspect.
5
What actions were taken against FEMA staff mentioned in the article?
FEMA terminated its CISO, CIO, and 22 other staff members due to claims of incompetence, though they denied it was related to a cyber attack.