The MITRE Corporation revealed on April 19 that it was one of over 1700 organizations compromised by a state-backed hacking group in January 2024. The MITRE data breach, which involved chaining two Ivanti VPN zero-days, highlights the evolving nature of cyber threats and the challenges organizations face in defending against them.

The MITRE data breach was detected after suspicious activity was noticed on MITRE's Networked Experimentation, Research, and Virtualization Environment (NERVE), an unclassified collaborative network used for research and development. [caption id="attachment_63933" align="aligncenter" width="609"] Source: X[/caption]

MITRE DATA Breach Discovery and Response

Following the detection, MITRE promptly took NERVE offline and launched an investigation with the assistance of both internal and external cybersecurity experts. "Following detection of the incident, MITRE took prompt action to contain the incident, including taking the NERVE environment offline, and quickly launched an investigation with the support of in-house and leading third-party experts. The investigation is ongoing, including to determine the scope of information that may be involved," reads the Official notice. MITRE CEO Jason Providakes emphasized that "no organization is immune from this type of cyber attack, not even one that strives to maintain the highest cybersecurity possible." Providakes highlighted the importance of disclosing the incident in a timely manner to promote best practices and enhance enterprise security. “We are disclosing this incident in a timely manner because of our commitment to operate in the public interest and to advocate for best practices that enhance enterprise security as well as necessary measures to improve the industry’s current cyber defense posture. The threats and cyber attacks are becoming more sophisticated and require increased vigilance and defense approaches. As we have previously, we will share our learnings from this experience to help others and evolve our own practices,” said Providakes. Charles Clancy, MITRE's Chief Technology Officer, provided additional insights, explaining that the threat actor compromised the Ivanti Connect Secure appliance used to provide connectivity into trusted networks. Clancy stressed the need for the industry to adopt more sophisticated cybersecurity solutions in response to increasingly advanced threats. MITRE outlined four key recommendations:

1. Advance Secure by Design Principles: Hardware and software should be inherently secure.
2. Operationalize Secure Supply Chains: Utilize software bill of materials to understand threats in upstream software systems.
3. Deploy Zero Trust Architectures: Implement micro-segmentation of networks in addition to multi-factor authentication.
4. Adopt Adversary Engagement: Make adversary engagement a routine part of cyber defense to provide detection and deterrence.

MITRE has a long history of contributing to cybersecurity research and development in the public interest. The organization has developed frameworks like ATT&CK®, Engage™, D3FEND™, and CALDERA™, which are used by the global cybersecurity community.

Details of the MITRE Data Breach

The MITRE data breach involved two zero-day vulnerabilities: an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887). These vulnerabilities allowed threat actors to bypass multi-factor authentication defenses and move laterally through compromised networks using hijacked administrator accounts. The attackers utilized sophisticated webshells and backdoors to maintain access to hacked systems and harvest credentials. Since early December, the vulnerabilities have been exploited to deploy multiple malware families for espionage purposes. Mandiant has attributed these attacks to an advanced persistent threat (APT) known as UNC5221, while Volexity has reported signs of Chinese state-sponsored actors exploiting the zero-days. Volexity discovered over 2,100 compromised Ivanti appliances, affecting organizations of various sizes globally, including Fortune 500 companies. The scale and severity of the attacks prompted the Cybersecurity and Infrastructure Security Agency (CISA) to issue an emergency directive on January 19, instructing federal agencies to mitigate the Ivanti zero-days immediately. MITRE's disclosure serves as a reminder of the ongoing threat posed by cyber adversaries and the critical need for organizations to continually enhance their cybersecurity defenses. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.