MITRE ATT&CKED: InfoSec’s Most Trusted Name Falls to Ivanti Bugs

Foreign nation-state hackers have used vulnerable Ivanti edge devices to gain three months’ worth of “deep” access to one of MITRE Corp.’s unclassified networks.

MITRE, steward of the ubiquitous ATT&CK glossary of commonly known cyberattack techniques, previously went 15 years without a major incident. The streak snapped in January when, like so many other organizations, its Ivanti gateway devices were exploited.

The breach affected the Networked Experimentation, Research, and Virtualization Environment (NERVE), an unclassified, collaborative network the organization uses for research, development, and prototyping. The extent of the NERVE damage (pun intended) is currently being assessed.

Dark Reading reached out to MITRE to confirm the timeline and details of the attack. MITRE did not provide further clarification.

MITRE’s ATT&CK

Stop me if you’ve heard this one before: In January, after an initial reconnaissance period, a threat actor exploited one of the company’s virtual private networks (VPNs) through two Ivanti Connect Secure zero-day vulnerabilities (ATT&CK technique T1190, Exploit Public-Facing Applications).

According to a blog post from MITRE’s Center for Threat-Informed Defense, the attackers bypassed the multifactor authentication (MFA) protecting the system with some session hijacking (MITRE ATT&CK T1563, Remote Service Session Hijacking).

To read the complete article, visit Dark Reading.