CISA Warns of Malicious Listener Malware Exploiting Ivanti Endpoint Manager Mobile

According to The Cybersecurity and Infrastructure Security Agency (CISA), a Malware Analysis Report details threat actors exploiting vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) to deploy malicious listeners and execute arbitrary code on compromised servers. The flaws, CVE-2025-4427 and CVE-2025-4428, were disclosed by Ivanti on 13 May 2025 and are classified as an authentication bypass (CWE-288) and code injection (CWE-94).

Attackers targeted the /mifs/rs/api/v2/ endpoint with crafted HTTP GET requests containing a ?format= parameter to issue remote commands, enabling them to collect system information, download malicious files, list the root directory, map the network, run scripts to create a heapdump, and dump LDAP credentials.

CISA identified two malware sets, Set 1 and Set 2, and described how the first loader injects a malicious listener into Apache Tomcat while the second uses WebAndroidAppInstaller[.]class to process requests, decrypt passwords, and load a malicious class.

The malware was delivered in Base64-encoded chunks to evade detection, and CISA urges organisations to upgrade Ivanti EPMM to the latest version, treat mobile device management systems as high-value assets with extra monitoring, and mandate phishing-resistant MFA for all staff and services.