MITRE says state hackers breached its network via Ivanti zero-days

MITRE disclosed that a state-backed actor exploited two Ivanti Connect Secure zero-days in January 2024 to breach its NERVE R&D network; the attackers chained CVE-2023-46805 and CVE-2024-21887, bypassed MFA via session hijacking, moved laterally using a hijacked admin account, and used webshells/backdoors to maintain access and harvest credentials—similar exploitation impacted thousands of Ivanti appliances worldwide and prompted a CISA emergency directive.