CISA Warns of Two Malware Strains Exploiting Ivanti EPMM CVE-2025-4427 and CVE-2025-4428

According to CISA, two sets of malware were found in an unnamed organisation’s network after Ivanti Endpoint Manager Mobile (EPMM) was exploited via CVE-2025-4427 and CVE-2025-4428, which have been abused as zero-days prior to Ivanti’s May 2025 fixes.

The threats include loaders that enable malicious listeners to run arbitrary code on the compromised server, with Set 1 comprising web-install.jar (Loader 1), ReflectUtil[.]class, and SecurityHandlerWanListener[.]class, and Set 2 comprising web-install.jar (Loader 2) and WebAndroidAppInstaller[.]class. Both sets contain a loader that launches a malicious Java listener to intercept specific HTTP requests and process them to decode and decrypt payloads for execution, enabling persistence and follow-on activity.

CISA notes that ReflectUtil[.]class injects the malicious SecurityHandlerWanListener into Apache Tomcat, while WebAndroidAppInstaller[.]class retrieves and decrypts a password parameter from requests using a hard-coded key to define and implement a new class, whose output is then encrypted and returned.

The agency added that the attackers gained access around May 15, 2025, before dropping the two sets of files to the /tmp directory for execution and data exfiltration, and it recommends updating to the latest Ivanti EPMM version, monitoring for suspicious activity, and restricting access to mobile device management systems.