CasesS=1:500S=1:100
MITRE breach: Ivanti VPN zero-days that bypassed MFA
Two flaws in the Ivanti VPN appliance, unpatched at the time, let the attacker past multi-factor authentication.
1 Summary
Starting in January 2024, an attacker exploited two zero-day vulnerabilities in Ivanti Connect Secure to breach one of MITRE's VPNs, then moved into the VMware infrastructure of its research network NERVE. MITRE disclosed the breach in April 2024. It was espionage, not ransomware, and MITRE attributes it to a Chinese nation-state actor.
Probable cause: Two flaws in the Ivanti VPN appliance, unpatched at the time, let the attacker past multi-factor authentication.
Source: MITRE MITRE Concludes Its Internal Cyber-Attack Investigation
S=1:100 2 Factual information
2.1 The way in
MITRE: the incident involved "two Ivanti Connect Secure zero-day vulnerabilities that bypassed our multi-factor authentication." The attacker breached one of MITRE's VPNs through them and hijacked sessions to move on.
Source: MITRE MITRE Concludes Its Internal Cyber-Attack Investigation
- Product
- Ivanti Connect Secure
- CVE
- CVE-2023-46805, CVE-2024-21887
2.2 After entry
The attacker hijacked VPN sessions, moved laterally into the VMware environment with an administrator account, created virtual machines for staging and persistence, and planted web shells and backdoors. MITRE said it did not detect the lateral movement into its VMware infrastructure.
2.3 Damage
MITRE's research and prototyping network, NERVE, was compromised. MITRE investigated with law enforcement and an outside forensics firm.
2.4 Sequence of events
| Time | Actor | Event | Source |
|---|---|---|---|
| 2024-01 | Intruder | Starts exploiting one of MITRE's VPNs through two Ivanti zero-days. | Help Net Security |
| 2024-04 | MITRE | Discloses that its NERVE research network was breached. | MITRE |
S=1:100 3 Analysis
| Point | Finding | Source |
|---|---|---|
| Two Ivanti Connect Secure zero-days were used, and they bypassed multi-factor authentication. | Stated | MITRE |
| The lateral movement into VMware was not detected. | Stated | Help Net Security |
| When MITRE first detected the compromise. | Unknown | Help Net Security |
S=1:100 4 Conclusions
MITRE concluded, with law enforcement and an outside forensics firm, that a Chinese nation-state actor entered through two Ivanti Connect Secure zero-days that bypassed its multi-factor authentication, and moved on into its VMware infrastructure.
S=1:100 5 Recommendations
The sources read for this page publish no list of measures.
Sources
Source: MITRE MITRE Concludes Its Internal Cyber-Attack InvestigationHelp Net Security MITRE breached by nation-state threat actor via Ivanti zero-days