State-backed hackers breach MITRE research network
MITRE's NERVE research network in the US was breached by state-backed hackers in December 2023. The attackers chained Ivanti VPN zero-day vulnerabilities, bypassed multi-factor authentication through session hijacking, and used web shells and backdoors whilst moving through the VMware environment. MITRE disclosed the breach in April 2024 and completed its internal investigation in May.
Key facts
- Affected organisation
- MITRE
- Incident type
- Hacking & intrusion
- Occurred / detected
- Not confirmed
- Scale of damage
- Breach of the NERVE research network
- Cause / method
- Chained exploitation of Ivanti VPN zero-day vulnerabilities and MFA bypass via session hijacking
- Location
- United States
Timeline
- MITRE disclosed the breach of its NERVE network by state-backed hackers exploiting Ivanti vulnerabilities.
- It emerged that China-linked attackers had infiltrated the systems in December 2023.
- It emerged that the attackers had abused VMware to maintain access and evade detection.
- MITRE completed its internal investigation into the cyber-attack.
5 related reports
- MITRE says state hackers breached its network via Ivanti zero-days
- Mitre breached by nation-state threat actor via Ivanti flaws
- MITRE Hack: China-Linked Group Breached Systems in December 2023
- VMware Abused in Recent MITRE Hack for Persistence, Evasion
- MITRE Concludes Its Internal Cyber-Attack Investigation
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.