China-Linked Hackers Used ROOTROT Webshell in MITRE Network Intrusion

MITRE disclosed that an adversary linked to UNC5221 exploited two Ivanti Connect Secure zero-days beginning December 31, 2023 to compromise its NERVE research environment, implanted multiple web shells and a Golang backdoor (ROOTROT, BRICKSTORM, BEEFLUSH, WIREFIRE), established persistence on VMware/ESXi hosts, harvested credentials, and attempted lateral movement and data exfiltration.