RSA SecurID Breach: The "2011 Recruitment Plan" Spear-Phishing Email (2011)

What Happened

In March 2011, RSA Security, the EMC division that makes the widely deployed SecurID two-factor authentication tokens, detected an intrusion it disclosed publicly on March 17 via an open letter from Executive Chairman Art Coviello and an EMC Form 8-K filed with the SEC. RSA characterized the intrusion as an Advanced Persistent Threat (APT) and said attackers had extracted information "specifically related to" its SecurID products.

At the time, RSA declined to specify what was taken, saying only that it "could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack."

In early April, RSA's Uri Rivner published a blog post ("Anatomy of an Attack") that revealed the entry point was mundane social engineering, not a novel exploit chain. Over a two-day period, attackers sent two spear-phishing emails to two small groups of ordinary, non-high-profile employees. The email carried the subject line "2011 Recruitment Plan" and a spoofed sender resembling a recruiting website (F-Secure later recovered a candidate sample spoofed to look like it came from webmaster@beyond.com).

The single-line body read, roughly, "I forward this file to you for review. Please open and view it." Attached was an Excel spreadsheet, "2011 Recruitment plan.xls," embedding a Flash object that exploited an Adobe Flash zero-day (CVE-2011-0609). Although at least one message was routed to a junk/spam folder, an employee retrieved it and opened the attachment, executing the exploit and dropping a variant of the Poison Ivy remote-access trojan.

From that foothold the attackers harvested credentials, escalated privileges from non-administrative users, and moved laterally to higher-value systems and administrators. They aggregated data on internal staging servers, compressed and encrypted it into password-protected RAR archives, and exfiltrated it via FTP to an external compromised host. The stolen SecurID data, widely believed to include token "seed" records, degraded the security guarantee of tokens already in the field.

The consequences became concrete in late May and were confirmed by RSA on June 2, 2011: information taken from RSA had been used as an element of an attempted broader attack on Lockheed Martin, the largest U.S. defense contractor, which pulled remote VPN access and reset passwords for roughly 120,000 workers. RSA then offered to replace SecurID tokens for customers focused on protecting intellectual property and corporate networks (of an estimated 40 million tokens in circulation) and offered monitoring to others.

EMC disclosed on its Q2 2011 earnings call that the incident cost about $66 million in that quarter alone.

How the Attack Worked

At an awareness level, the attack shows how a world-class security company can be breached through one person and one click. The kill chain: (1) Recon and contact, attackers picked a pretext relevant to corporate life, a "recruitment plan," and sent it to small groups of rank-and-file employees rather than executives, lowering suspicion. (2) Rapport and legitimacy, the sender was spoofed to resemble a known recruiting service, and the ask ("please review this file") mirrored routine forwarding of documents. (3) Exploitation, opening the Excel attachment silently triggered an embedded Flash zero-day that installed a remote-access trojan; because it was a zero-day, patching could not have prevented it, which is why the human decision to open the file was the decisive control that failed. (4) Escalation and spread, with a foothold, attackers stole credentials, elevated privileges, and pivoted to administrators and systems holding SecurID secrets. (5) Payout and exfiltration, data was staged internally, packaged into encrypted archives, and shipped out to an external host.

The strategic lesson: the initial compromise looked ordinary, but because the victim was an authentication vendor, the stolen data became a master key enabling a second-stage supply-chain attack on RSA's own customers.

The Lure & the Tell

Pretext: an email subject-lined "2011 Recruitment Plan" with a one-line body ("I forward this file to you for review. Please open and view it.") and an attachment "2011 Recruitment plan.xls," from a sender spoofed to look like a recruiting site. Red flags visible in hindsight: the message had already been auto-classified as junk/spam and had to be pulled out of the spam folder; the body was a terse, generic one-liner with no personalization or context; the "recruitment plan" was unsolicited and irrelevant to most recipients' actual duties; and it pushed an unexplained attachment with an urgent "open and view it" ask.

The tell was less about a typo than about an unexpected, contextless file-open request from an outside party.

Outcome

Attackers exfiltrated SecurID-related data (widely believed to include token seed records). RSA disclosed the breach March 17, 2011, and confirmed on June 2 that the stolen data was used in an attempted attack on Lockheed Martin. RSA offered mass token replacement (against an estimated 40 million tokens in the field) and customer monitoring; EMC reported ~$66M in Q2 2011 remediation costs.

No public attribution, arrest, or indictment was ever confirmed. The incident became a landmark case study in spear phishing, supply-chain risk, and the limits of two-factor authentication when the vendor itself is compromised.

Why It Matters

This is the canonical example that a single well-placed email can defeat even a security company, and that a breach of a trusted vendor cascades into a supply-chain attack on its customers. It reframed "advanced persistent threat" for the public: the exploit was advanced (a Flash zero-day), but the way in was a plain, unsophisticated phishing email that one employee chose to open.

It also punctured the assumption that hardware two-factor tokens are unbreakable, since the secrets behind them can be stolen upstream. For awareness training, it is the definitive lesson that people, not just patches, are the last line of defense, and that "it was in my spam folder" is a warning, not a hurdle to clear.

Defenses

User awareness that unexpected, contextless attachments (especially ones already flagged as spam) should be verified out-of-band, not retrieved and opened; treating "please open and view this file" from external senders as a phishing indicator. Technical controls: robust email filtering and not letting users trivially override quarantine; disabling or sandboxing risky active content (Flash/macros/embedded objects) in Office documents; application allow-listing and least-privilege to blunt privilege escalation; network segmentation and monitoring to detect lateral movement and large encrypted-archive FTP exfiltration; egress filtering to block unexpected outbound FTP to unknown hosts; and protecting authentication seed material (segmentation, HSMs, strict access controls) so a single foothold cannot reach crown-jewel secrets.

Post-incident, transparent and specific customer disclosure would have let downstream victims like Lockheed Martin defend themselves sooner.