CISA warns of malware deployed through Ivanti EPMM flaws

CISA warns of malware deployed through Ivanti EPMM flaws, after two malware strains were found in a network compromised by exploiting CVE-2025-4427 and CVE-2025-4428 in Ivanti Endpoint Manager Mobile (EPMM). In May 2025, threat actors used the flaws to access servers, performing actions via the /mifs/rs/api/v2/ endpoint, including gathering system data, downloading malware, mapping networks, dumping LDAP credentials, and maintaining persistence by writing malicious files to /tmp.

CISA analysed two malware sets, with Set 1 consisting of web-install.jar, ReflectUtil[.]class, and SecurityHandlerWanListener[.]class, and Set 2 comprising web-install.jar and WebAndroidAppInstaller[.]class, each including a loader and a listener to inject and execute arbitrary code on the compromised server. Set 1 disguises a loader as an Apache package to install a malicious listener into Tomcat, while Set 2 poses as a MobileIron service to intercept HTTP requests and decrypt payloads for execution.

Ivanti released security updates mid-May to address CVE-2025-4427 and CVE-2025-4428, and CERT-EU reported the vulnerabilities to the firm; CISA urged organisations to update, monitor for IOCS, and follow detection guidance, including the use of YARA and SIGMA rules.