The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released a detailed technical analysis of sophisticated malware used in cyberattacks against Ivanti Endpoint Manager Mobile (EPMM) systems. The attacks exploited two critical zero-day vulnerabilities that security experts believe were leveraged by Chinese state-sponsored hackers.

## The Vulnerabilities

Two severe security flaws enabled the attacks:

– **CVE-2025-4427**: An authentication bypass vulnerability in EPMM’s API component
– **CVE-2025-4428**: A code injection flaw allowing arbitrary code execution

These vulnerabilities affected multiple Ivanti EPMM versions, including 11.12.0.4, 12.3.0.1, 12.4.0.1, and 12.5.0.0, along with their earlier releases.

## Timeline of the Attack

While Ivanti patched these vulnerabilities on May 13, threat actors had already been exploiting them as zero-days against a limited number of customers. Intelligence firm EclecticIQ later confirmed with high confidence that a China-linked espionage group had been actively using these exploits since at least May 15.

The Chinese threat actors demonstrated sophisticated knowledge of Ivanti EPMM’s internal architecture, skillfully repurposing system components to steal sensitive data.

## How the Malware Worked

CISA’s analysis revealed a sophisticated attack methodology involving two distinct malware sets, each containing five files designed to compromise on-premise Ivanti EPMM systems.

**Attack Method:**
– Hackers targeted the `/mifs/rs/api/v2/` endpoint using HTTP GET requests
– Used the `?format=` parameter to deliver malicious commands
– Conducted reconnaissance by collecting system information, mapping networks, and extracting LDAP credentials

**Malware Components:**
The attackers deployed two malware sets, each featuring unique loaders but similar functionality:

– **Set 1**: Included `web-install.jar` (Loader 1) with `ReflectUtil.class` and `SecurityHandlerWanListener.class`
– **Set 2**: Featured `web-install.jar` (Loader 2) with `WebAndroidAppInstaller.class`

Both sets functioned as malicious listeners capable of injecting code, establishing persistence, and exfiltrating data from compromised systems.

## Delivery Technique

The threat actors used a sophisticated delivery method, transmitting malware through separate HTTP GET requests in segmented, Base64-encoded chunks. This approach helped evade detection while ensuring successful payload delivery.

## CISA’s Response and Recommendations

CISA has provided comprehensive detection tools, including:
– Detailed indicators of compromise (IOCs)
– YARA detection rules
– SIGMA rules for threat hunting

**Immediate Actions for Organizations:**
1. **Isolate** affected systems immediately
2. **Collect** and review security artifacts
3. **Create** full forensic disk images for analysis
4. **Share** findings with CISA

**Long-term Security Measures:**
– Apply Ivanti EPMM patches immediately
– Treat mobile device management (MDM) systems as high-value assets requiring enhanced security monitoring
– Implement additional security restrictions around MDM infrastructure

## The Bigger Picture

This incident highlights the ongoing threat posed by sophisticated nation-state actors targeting enterprise mobile management systems. The attackers’ deep understanding of Ivanti’s architecture suggests extensive reconnaissance and preparation, emphasizing the need for organizations to prioritize security around critical infrastructure components.

Organizations using Ivanti EPMM should treat this as a wake-up call to strengthen their mobile device management security posture and implement comprehensive monitoring solutions to detect similar advanced persistent threats.