MITRE Corporation Breached by Nation-State Hackers Exploiting Ivanti Flaws

MITRE disclosed that beginning in January 2024 it was targeted by a nation-state actor that exploited two Ivanti Connect Secure zero-days (CVE-2023-46805 and CVE-2024-21887) to bypass authentication through session hijacking, gain access to its NERVE research network, move laterally into VMware using a compromised admin account, and deploy backdoors and web shells; Volexity attributes the initial exploitation to China-linked UTA0178 and other China-nexus groups have since exploited the same flaws, while MITRE says its core enterprise network and partners appear unaffected and containment and forensic response actions are underway.