Sunken Ships: Will Orgs Learn From Ivanti EPMM Attacks?

The Ivanti Endpoint Manager Mobile (EPMM) zero-day exploits began in April 2025 and persisted into the summer, exploiting patching lag to compromise thousands of organisations, with Europe heavily affected and a government entity in the United Kingdom cited among victims. Attacks chained two zero-day vulnerabilities, CVE-2025-4427 and CVE-2025-4428, to achieve remote code execution, and Ivanti issued a patch on 13 May 2025, followed by a proof-of-concept release two days later.

EclecticIQ attributed the campaign with high confidence to a China-nexus APT group, noting the C2 infrastructure was hosted on China Telecom and that Mandarin-language reconnaissance tools were used. Researchers described the attack chain as enabling an adversary-in-the-middle capability, including the ability to add or remove users, locate devices, and push security configurations, effectively turning compromised devices into a powerful foothold for further breaches.

The article emphasises that while vulnerability management helps, zero-day attacks require additional measures, such as monitoring for abuse of legitimate enterprise features and prioritising top-tier threat modelling for Internet-facing applications. According to EclecticIQ, the resulting exposure could allow data exfiltration and targeted social engineering, underscoring the need for heightened vigilance beyond patching alone.