Dive Brief:

• Mitre Corp. said one of its research and prototyping networks was intruded in January by a nation-state linked attacker that exploited a pair of zero-day vulnerabilities in the organization’s remote access Ivanti VPN.
• “We took all the recommended actions from the vendor, from the U.S. government, but they were clearly not enough,” Charles Clancy, SVP and CTO at Mitre, said Friday in a video statement. “As a result, we are issuing a call to action to the industry. The threat has gotten more sophisticated, and so too must our solutions to combat that threat.”
• Mitre detected the cyberattack in its Network Experimentation, Research and Virtualization Environment, and the company quickly took the unclassified, collaborative network offline. “Based on our investigation to date, there is no indication that MITRE’s core enterprise network or partners’ systems were affected by this incident,” Mitre said Friday.

Dive Insight:

Mitre, a non-profit organization with close ties to the federal government and plays a central role in cyber defense research, is one of about 1,700 entities impacted by zero-day exploits in Ivanti Connect Secure products this year.

Mitre operates federally funded research and development centers for U.S. government sponsors. Some of Mitre’s contributions to the cybersecurity sector include CVE.org and the Mitre Att&ck matrix and knowledge base of attackers’ tactics and techniques.

The zero-day exploits of Ivanti products have ensnared some of the most important organizations and agencies in cybersecurity. The Cybersecurity and Infrastructure Security Agency was also hit in January by a yet-to-be identified attacker that exploited the critical vulnerabilities in Ivanti products the agency used at the time.

The attack against Mitre, which involved lateral movement from an Ivanti VPN into VMware infrastructure, occurred before the Ivanti zero-day vulnerabilities were disclosed, Charles Clancy, SVP and CTO at Mitre, said Friday in a LinkedIn post.

The attacker performed reconnaissance on one of Mitre’s networks, exploited one of its Ivanti VPNs and “skirted past our multifactor authentication using session hijacking,” Clancy and Lex Crumpton, defensive cyber operations researcher, said in a blog post.

“From there, they moved laterally and dug deep into our network’s VMware infrastructure using a compromised administrator account. They employed a combination of sophisticated backdoors and webshells to maintain persistence and harvest credentials,” Clancy and Crumpton said.

Mitre said the attack underscores the need to advance secure-by-design principles, improve supply chain security, micro-segment networks and deploy zero-trust architecture. The company did not immediately respond to a request for comment.

An investigation into the full impact and scope of information exposed as a result of the attack is ongoing.