Chinese Cyberattacks Exploit Vulnerabilities in Ivanti EPMM

On 22 May 2025, The Hacker News reported that the Chinese cyber-espionage group UNC5221 had exploited two recently patched vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) software to carry out targeted attacks worldwide. The vulnerabilities, tracked as CVE-2025-4427 and CVE-2025-4428, allow arbitrary code execution on vulnerable devices without authentication.

Targeted sectors and attack methods

The attacks, which began on 15 May 2025, targeted critical sectors including healthcare, telecommunications, aviation, local government, finance and defence across Europe, North America and the Asia-Pacific region. UNC5221 demonstrated in-depth knowledge of EPMM's internal architecture, using legitimate system components to exfiltrate data covertly.

Techniques used by the attackers

The group exploited the "/mifs/rs/api/v2/" endpoint to establish an interactive reverse shell and execute remote commands on Ivanti EPMM deployments. It then deployed KrustyLoader, a Rust-based loader attributed to UNC5221, which can deliver additional payloads such as Sliver. The attackers also used hard-coded MySQL credentials to gain unauthorised database access and exfiltrate sensitive data relating to managed mobile devices, LDAP users and Office 365 access tokens.

Command-and-control tools and infrastructure

The attacks involved obfuscated shell commands for host reconnaissance, followed by the delivery of KrustyLoader from an AWS S3 bucket and the use of Fast Reverse Proxy (FRP) to facilitate network reconnaissance and lateral movement. FRP is an open-source tool widely shared among Chinese hacking groups.

Recommendations for organisations

Ivanti released patches for both vulnerabilities and strongly recommended that customers follow the guidance in its official security advisory to secure their environments as soon as possible.

Conclusion

UNC5221's attacks underline the importance of proactive vulnerability management and enterprise mobile-device security. Organisations should ensure that security patches are applied promptly and continuously monitor their infrastructure for suspicious activity.