Ivanti disclosed two critical vulnerabilities, identified as CVE-2025-4427 and CVE-2025-4428, affecting Ivanti Endpoint Manager Mobile (EPMM) version 12.5.0.0 and earlier.
These flaws, when chained together, allow unauthenticated remote code execution (RCE) on internet-facing systems, posing a severe risk to enterprise security.
EclecticIQ analysts have confirmed active exploitation in the wild since the disclosure date, with attackers targeting critical sectors such as healthcare, telecommunications, aviation, finance, and defense across Europe, North America, and Asia-Pacific.
Ivanti has released patches to address these vulnerabilities and urges customers to follow the official security advisory to secure their environments immediately.
Critical Flaws Enable Remote Code Execution
According to the Report, EclecticIQ attributes this exploitation with high confidence to UNC5221, a China-nexus espionage group known for zero-day attacks on edge network appliances since at least 2023.
The attackers demonstrate deep knowledge of EPMM’s architecture, exploiting the /mifs/rs/api/v2/ endpoint via the ?format= parameter to execute malicious Java commands using reflection techniques.
These commands enable arbitrary code execution and establish reverse shells for continuous communication with compromised systems.
Sophisticated Tactics by UNC5221 Group
Post-exploitation, UNC5221 deploys KrustyLoader malware, delivered via compromised Amazon AWS S3 buckets, to install the Sliver backdoor, ensuring persistent access through AES-encrypted payloads loaded directly into memory as shellcode.
Additionally, hardcoded MySQL credentials in EPMM’s configuration files are abused to access the mifs database, exfiltrating sensitive data like device telemetry, LDAP user details, and Office 365 tokens, which could facilitate lateral movement and further espionage.
The threat actors also leverage tools like FRP (Fast Reverse Proxy) to establish SOCKS5 proxies for internal network reconnaissance and use obfuscated shell commands to gather system intelligence, saving outputs in fake JPG files to evade detection.
Infrastructure reuse, such as IP addresses previously tied to SAP NetWeaver exploits, and connections to the Auto-Color Linux backdoor further solidify the link to China-nexus cyber-espionage, likely aligned with state intelligence objectives.
The victimology spans global organizations, exposing vast datasets of personally identifiable information (PII) and credentials, amplifying the potential impact of these intrusions on enterprise and governmental security.
Organizations are advised to monitor HTTP request logs, file system activities in /tmp/ directories, and apply regex-based detection for suspicious RCE attempts to safeguard against this ongoing threat.
Indicators of Compromise (IOCs)
| Type | Indicator | Description |
|---|---|---|
| IP Address | 103.244.88[.]125 | Hosts FRP binary delivery |
| IP Address | 27.25.148[.]183 | Reused from prior UNC5221 campaigns |
| IP Address | 146.70.87[.]67:45020 | Linked to Auto-Color C2 infrastructure |
| Domain (AWS S3) | openrbf.s3.amazonaws[.]com, tkshopqd.s3.amazonaws[.]com | Used for KrustyLoader payload delivery |
| Domain (Staging URL) | http://abbeglasses.s3.amazonaws[.]com/dSn9tM | Hosts encrypted Sliver backdoor |
| File Hash (KrustyLoader) | 44c4a0d1826369993d1a2c4fcc00a86bf45723342cfd9f3a8b44b673eee6733a | Malware sample for persistence |
Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!