Ivanti EPMM holes let miscreants plant shady listeners, CISA says

An unknown attacker has abused a couple of flaws in Ivanti Endpoint Manager Mobile (EPMM) and deployed two sets of malware against an unnamed organization, according to the US Cybersecurity and Infrastructure Security Agency. While CISA doesn't attribute this compromise to a particular group, both of these flaws, CVE-2025-4427 and CVE-2025-4428, were exploited as zero-days before Ivanti disclosed and patched them on May 13. Soon after, private security researchers blamed suspected Chinese government spies for the intrusions. CVE-2025-4427 is an authentication bypass vulnerability and CVE-2025-4428 is a post-authentication remote code execution (RCE) flaw. The two can be chained to run malware on - and hijack - vulnerable deployments. In a Thursday alert, CISA said the intrusion it investigated happened around May 15 after a proof-of-concept exploit became available, and the unnamed attacker accessed the organization's server running EPMM by chaining both CVEs. Both malware sets contain "loaders for malicious listeners that enable cyber threat actors to run arbitrary code on the compromised server," the cyber-defense agency said. While CISA doesn't name the victim company or indicate what sector it belongs to, Australia's intelligence agency previously warned large organizations and government entities to be on the lookout for suspicious activity targeting these two Ivanti EPMM bugs for attacks. According to CISA's analysis, the malware set 1 consists of three malicious files:...