All CISA Advisories, EN

Malicious Listener for Ivanti Endpoint Mobile Management Systems

Malware Analysis at a Glance
Executive Summary The Cybersecurity and Infrastructure Security Agency (CISA) obtained two sets of malware from an organization compromised by cyber threat actors exploiting CVE-2025-4427 and CVE-2025-4428 in Ivanti Endpoint Manager Mobile (Ivanti EPMM). Each set contains loaders for malicious listeners that enable cyber threat actors to run arbitrary code on the compromised server. 
Affected Products Ivanti EPMM, versions 11.12.0.4 and prior, 12.3.0.1 and prior, 12.4.0.1 and prior, and 12.5.0.0 and prior. (Ivanti provided a patch and disclosed the vulnerabilities on May 13, 2025.)
Key Actions
  • Detect activity by using the indicators of compromise (IOCs) and detection signatures to identify malware samples.
  • Prevent compromise by upgrading Ivanti EPMM versions to the latest version as soon as possible.
  • Prevent compromise by treating mobile device management (MDM) systems as high-value assets (HVAs) with additional restrictions and monitoring. 
Indicators of Compromise For a downloadable copy of IOCs associated with this malware, see: MAR-251126.r1.v1.CLEAR.
Detection

This malware analysis report includes YARA and SIGMA rules.

For a downloadable copy of the SIGMA rule associated with this malware, see: AR25-260A/B SIGMA YAML.
Intended Audience

Organizations: All organizations with on-premises Ivanti EPMM systems.

Roles: This article has been indexed from All CISA Advisories