MITRE NERVE network breached via Ivanti zero-days and session hijacking
MITRE disclosed on April 19, 2024 that a foreign nation-state actor breached NERVE, its unclassified research and prototyping network, starting in January 2024. The attacker exploited two Ivanti Connect Secure zero-days, CVE-2023-46805 and CVE-2024-21887, hijacked VPN sessions to get past MFA and move laterally into MITRE's VMware infrastructure, and used compromised accounts including an administrator account. MITRE did not name the actor.
- Victim
- MITRE
- Industry
- Government
- Country
- United States
- Intrusion began
- Jan 2024
- First disclosed
- Apr 19, 2024
- Actor
- Nation-state
- Initial access
- Identity infrastructure vulnerability
- Identity control that failed
- Session and tokens
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
MFA at the VPN does not survive a hijacked session or an auth bypass in the gateway itself. Session binding, rapid patching of remote access appliances and re-authentication before admin actions inside the network would have narrowed the path.
Go deeper on SWI
- Technique: Session cookie theft
- Vulnerability: Ivanti Connect Secure authentication bypass
Sources
- MITRE breached by nation-state threat actor via Ivanti zero-days, Help Net Security, Apr 22, 2024
- MITRE hacked by state-sponsored group via Ivanti zero-days, SecurityWeek, Apr 22, 2024
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Boeing Distribution breached by LockBit via Citrix Bleed session hijacking 2023 · Identity infrastructure vulnerability
- GlobalProtect authentication bypass used as a ransomware front door 2026 · Identity infrastructure vulnerability
- Comcast Xfinity customer data theft via Citrix Bleed 2023 · Identity infrastructure vulnerability
- BeyondTrust Remote Support zero-day used to dump the appliance credential vault 2026 · Identity infrastructure vulnerability
Cite this record
SWI Community Team. (2026). MITRE NERVE network breached via Ivanti zero-days and session hijacking. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2024-mitre-nerve-ivanti-session-hijack/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.