MITRE Corporation disclosed it was compromised by a nation-state attack leveraging two Ivanti Connect Secure vulnerabilities, tracked as CVE-2023-46805 and CVE-2024-21887, in January, according to The Record, a news site by cybersecurity firm Recorded Future. After infiltrating the Ivanti appliance through the flaws in early January, attackers proceeded with lateral movement to MITRE’s VMware infrastructure by hijacking a stolen administrator account before eventually breaching its unclassified collaborative research and development network, which offers computing, storage, and networking resources, said MITRE Chief Technology Officer Charles Clancy.

Source: SC Magazine