Security News > 2025 > May > Chinese cyber spies are using Ivanti EPMM flaws to breach EU, US organizations
2025-05-23 14:13
CVE-2025-4427 and CVE-2025-4428 – the two Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities that have been exploited in the wild as zero-days and patched by Ivanti last week – are being leveraged by a Chinese cyber espionage group that has been exploiting zero-days in edge network appliances since at least 2023, EcleticIQ researchers have shared. Among the entities targeted in this campaign were: a local government authority and healthcare organizations in the UK; a research institute, … More → The post Chinese cyber spies are using Ivanti EPMM flaws to breach EU, US organizations appeared first on Help Net Security.
News URL
Related news
- Suspected Chinese spies right now hijacking buggy Ivanti gear – for third time in 3 years (source)
- Hertz data breach: Customers in US, EU, UK, Australia and Canada affected (source)
- Chinese hackers breach US local governments using Cityworks zero-day (source)
- Ivanti EPMM flaw exploited by Chinese hackers to breach govt agencies (source)
- Ivanti makes dedicated fans of Chinese spies who just can't resist attacking its buggy kit (source)
- EU gives staff 'burner phones, laptops' for US visits (source)
- Chinese snoops use stealth RAT to backdoor US orgs – still active last week (source)
- Luna Moth extortion hackers pose as IT help desks to breach US firms (source)
- As US vuln-tracking falters, EU enters with its own security bug database (source)
- Chinese Hackers Exploit Ivanti EPMM Bugs in Global Enterprise Network Attacks (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2025-05-13 | CVE-2025-4428 | Code Injection vulnerability in Ivanti Endpoint Manager Mobile 12.5.0.0 Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests. | 8.8 |
| 2025-05-13 | CVE-2025-4427 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Ivanti Endpoint Manager Mobile 12.5.0.0 An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API. | 7.5 |