CISA Alerts of Hackers Targeting Ivanti Endpoint Manager Mobile Vulnerabilities to Distribute Malware

According to CISA, cyber threat actors weaponised two critical Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities—CVE-2025-4427 and CVE-2025-4428—to deploy sophisticated loaders and listeners on compromised servers. The malware comprises two loader components designed to inject arbitrary code and maintain persistence on Apache Tomcat deployments, with Loader 1 and Loader 2 performing distinct loading and execution tasks.

CISA states five malware files were obtained from an organisation compromised via these CVEs, which were exploited through the /mifs/rs/api/v2/ endpoint by chaining HTTP GET requests with a format parameter to deliver Base64-encoded chunks. Ivanti patched these vulnerabilities and publicly disclosed them on 13 May 2025, and CISA added the CVEs to its Known Exploited Vulnerabilities Catalog on 19 May 2025.

The agency recommends upgrading to the latest Ivanti EPMM release and deploying detections such as IOCs, YARA, and SIGMA rules to identify the loaders, listeners, and suspicious HTTP requests, while treating MDM systems as high-value assets with enhanced monitoring.