Chinese Hackers Deployed Backdoor Quintet to Down MITRE

MITRE disclosed that Chinese-linked attackers exploited Ivanti Connect Secure zero-day vulnerabilities to breach its NERVE research environment between New Year's Eve and mid‑March, deploying multiple web shells and backdoors — Rootrot (Ivanti TCC backdoor), Brickstorm (Golang vCenter backdoor), Wirefire/Gifted Visitor (Python web shell), Bushwalk (Perl web shell variant), and Beeflush (web shell that reads/encrypts web traffic) — enabling reconnaissance, lateral movement, command-and-control, and file operations; MITRE emphasized secure-by-design, zero trust, continuous authentication, and SBOMs as mitigations.