CISA Analyzes Malware From Ivanti EPMM Intrusions

According to CISA, malware deployed in attacks targeting Ivanti EPMM exploited two vulnerabilities, CVE-2025-4427 (CVSS 5.3) and CVE-2025-4428 (CVSS 7.2), which were disclosed on 13 May after initial exploitation began. By late May, it emerged that a China-linked threat actor tracked as UNC5221 had been abusing the flaws in attacks.

CISA notes that the flaws are an authentication bypass and a remote code execution issue found in two open source libraries integrated into EPMM, which can be chained for unauthenticated RCE. The agency has shared IoCs and detection rules for two sets of malware (five files) collected from a network compromised through the vulnerability exploitation, with chains enabling remote commands to collect system information, enumerate directories, deploy files, perform network reconnaissance, and dump LDAP credentials.

Both malware sets included a loader and a malicious listener to enable arbitrary code execution, with the first set containing a manager to inject the listener into Apache Tomcat. CISA recommends updating to patched EPMM versions 11.12.0.5, 12.3.0.2, 12.4.0.2, 12.5.0.1, or newer, and implementing stricter monitoring for mobile device management.