Chinese Hackers Exploit Ivanti EPMM Bugs in Global Enterprise Network Attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-31324 | Unauthenticated File Upload RCE in SAP NetWeaver Visual Composer CVE-2025-31324 is a critical (CVSS 9.8) unrestricted file upload flaw (CWE-434) in the Visual Composer Metadata Uploader component of SAP NetWeaver, which lacks proper authorization. An unauthenticated attacker can send crafted upload requests over the network to the Metadata Uploader endpoint and plant malicious executable binaries, such as webshells, on the host. Executing the uploaded files yields remote code execution with full impact on confidentiality, integrity, and availability, enabling system compromise, lateral movement, and ransomware deployment. Any organization running the affected SAP NetWeaver component is at risk, with the greatest exposure for instances reachable from the internet. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2025-04-29, a public PoC exists, and researchers and media report active attacks, including by Chinese-linked actors deploying Golang-based implants on Linux systems and known ransomware use, often chained with CVE-2025-42999. Do: Apply SAP's patch for CVE-2025-31324 (released in the April 2025 security updates) and follow the vendor mitigation instructions per CISA KEV/BOD 22-01 requirements. As interim mitigation, restrict or disable the Visual Composer Metadata Uploader endpoint and ensure it is not reachable from the internet; also patch the related CVE-2025-42999 since the flaws are being chained. Check affected hosts for uploaded webshells, Golang-based implants, and signs of ransomware activity. | 9.8 | 100% | KEV ransomware PoC |
| largetens of thousands of enterprise deployments worldwide, with several thousand instances directly internet-exposed | |
| CVE-2025-4428 +1 in the same advisory: …4427 | Authenticated Code Injection RCE in Ivanti Endpoint Manager Mobile (EPMM) API CVE-2025-4428 is a code injection flaw (CWE-94) in the API component of Ivanti Endpoint Manager Mobile (EPMM) that lets an authenticated, low-privileged remote attacker execute arbitrary code by sending crafted API requests. Successful exploitation yields code execution on the MDM server itself (CVSS 8.8, High), which typically holds device inventory and administrative control over an organization's enrolled mobile fleet. Any organization running EPMM 12.5.0.0 or earlier is in scope. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-05-19, EPSS puts the 30-day exploitation probability at 86% (100th percentile), and public reporting ties limited attacks to the China-linked actor UNC5221, who reportedly began exploiting it alongside the companion API authentication bypass CVE-2025-4427 shortly after disclosure. CISA has also warned that threat actors exploiting these EPMM flaws deploy two malware strains; ransomware involvement has not been confirmed. Do: Upgrade every EPMM instance running 12.5.0.0 or earlier to the patched release per Ivanti's security advisory, prioritizing internet-facing servers, and note that federal agencies must satisfy the BOD 22-01 required action (patch, apply vendor mitigations, or discontinue use of the product). If patching is delayed, restrict internet exposure of the API and review EPMM logs and the advisory's indicators of compromise, since attackers have chained this flaw with the CVE-2025-4427 authentication bypass and deployed malware. Treat any unpatched, exposed EPMM instance as actively targeted until it is remediated. | 8.8 group max | 86% | KEV |
| largetens of thousands of enterprise deployments (order of 10k-100k EPMM servers; many are internet-exposed) |
Full article564 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMay 22, 2025Enterprise Security / Malware
A recently patched pair of security flaws affecting Ivanti Endpoint Manager Mobile (EPMM) software has been exploited by a China-nexus threat actor to target a wide range of sectors across Europe, North America, and the Asia-Pacific region.
The vulnerabilities, tracked as CVE-2025-4427 (CVSS score: 5.3) and CVE-2025-4428 (CVSS score: 7.2), could be chained to execute arbitrary code on a vulnerable device without requiring any authentication. They were addressed by Ivanti last week.
Now, according to a report from EclecticIQ, the vulnerability chain has been abused by UNC5221, a Chinese cyber espionage group known for its targeting of edge network appliances since at least 2023. Most recently, the hacking crew was also attributed to exploitation efforts targeting SAP NetWeaver instances susceptible to CVE-2025-31324.
The Dutch cybersecurity company said the earliest exploitation activity dates back to May 15, 2025, with the attacks targeting healthcare, telecommunications, aviation, municipal government, finance, and defense sectors.
"UNC5221 demonstrates a deep understanding of EPMM's internal architecture, repurposing legitimate system components for covert data exfiltration," security researcher Arda Büyükkaya said. "Given EPMM's role in managing and pushing configurations to enterprise mobile devices, a successful exploitation could allow threat actors to remotely access, manipulate, or compromise thousands of managed devices across an organization."
The attack sequence involves targeting the "/mifs/rs/api/v2/" endpoint to obtain an interactive reverse shell and remotely execute arbitrary commands on Ivanti EPMM deployments. This is followed by the deployment of KrustyLoader, a known Rust-based loader attributed to UNC5221 that enables the delivery of additional payloads like Sliver.
The threat actors have also been observed targeting the mifs database by making use of hard-coded MySQL database credentials stored in /mi/files/system/.mifpp to obtain unauthorized access to the database and exfiltrating sensitive data that could grant them visibility into managed mobile devices, LDAP users, and Office 365 refresh and access tokens.
Furthermore, the incidents are characterized by the use of obfuscated shell commands for host reconnaissance before dropping KrustyLoader from an AWS S3 bucket and Fast Reverse Proxy (FRP) to facilitate network reconnaissance and lateral movement. It's worth mentioning here that FRP is an open-source tool widely shared among Chinese hacking groups.
EclecticIQ said it also identified a command-and-control (C2) server associated with Auto-Color, a Linux backdoor that was documented by Palo Alto Networks Unit 42 as used in attacks aimed at universities and government organizations in North America and Asia between November and December 2024.
"The IP address 146.70.87[.]67:45020, previously associated with Auto-Color command-and-control infrastructure, was seen issuing outbound connectivity tests via curl immediately after exploitation of Ivanti EPMM servers," Büyükkaya pointed out. "This behaviour is consistent with Auto-Color's staging and beaconing patterns. Taken together, these indicators very likely link to China-nexus activity."
The disclosure comes as threat intelligence firm GreyNoise noted that it had witnessed a significant spike in scanning activity targeting Ivanti Connect Secure and Pulse Secure products prior to the disclosure of CVE-2025-4427 and CVE-2025-4428.
"While the scanning we observed was not directly tied to EPMM, the timeline underscores a critical reality: scanning activity often precedes the public emergence of zero-day vulnerabilities," the company said. "It's a leading indicator — a signal that attackers are probing critical systems, potentially in preparation for future exploitation."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/05/chinese-hackers-exploit-ivanti-epmm.html