Nation-State hackers exploit MITRE network with zero-day vulnerabilities, penetrating research

TLDR:

Key Points:

• Nation-state hackers breached MITRE’s cybersecurity research network using two zero-day vulnerabilities in Ivanti products.
• The attackers were able to move laterally, install webshells and backdoors, and exfiltrate data.

The breach at MITRE’s Networked Experimentation, Research, and Virtualization Environment (NERVE) involved the exploitation of two zero-day vulnerabilities in Ivanti’s Connect Secure VPN devices. Despite these vulnerabilities being patched by Ivanti weeks after disclosure, the attackers were able to infiltrate MITRE’s R&D network. While the specific nationality of the nation-state hackers is unconfirmed, similarities in their tactics with other incidents suggest that they may be Chinese.

Third-party security research firms, such as Mandiant, have observed Chinese nation-state hackers leveraging these Ivanti vulnerabilities in various exploits. The attackers were able to gain access to at least one administrator account, establish persistent access with backdoors, and exfiltrate data from the breached network.

The incident highlights the ongoing risks faced by organizations involved in national security and technological research. It also underscores the importance of patching vulnerabilities promptly, as the attackers exploited the Ivanti flaws shortly after their public disclosure, emphasizing the need for organizations to prioritize timely patching and proactive security measures in the face of growing cyber threats.