Ivanti EPMM Flaws Exploited to Deliver KrustyLoader Malware
Summary
Darktrace reports observing exploitation of Ivanti EPMM vulnerabilities CVE-2025-4427 and CVE-2025-4428 across customer environments, including OAST-based validation, AWS-hosted payloads, and KrustyLoader delivery.
Key points
- The flaws—an authentication bypass (CVE-2025-4427) and remote code execution vulnerability (CVE-2025-4428)—can be chained for unauthenticated remote code execution.
- Darktrace observed suspected exploitation across customer environments in May 2025, shortly after Ivanti disclosed the vulnerabilities.
- Observed activity included OAST callbacks for exploit validation and downloads of ELF payloads from AWS S3 endpoints using tools such as wget and cURL.
- Some downloaded payloads were identified as KrustyLoader, a Rust-based malware associated with establishing persistence.
- Other activity included script downloads and connections to pastebin and dpaste, potentially for retrieving or updating payloads.
- Darktrace assessed that the activity may involve UNC5221, a suspected China-nexus espionage actor; attribution is not confirmed.
Article Details
- Attack Vectors
- CVE-2025-4427 authentication bypass and CVE-2025-4428 remote code execution were reportedly exploited together against Ivanti EPMM devices.
- Exploit validation included DNS requests and connections to OAST endpoints, potentially triggering callbacks from targeted systems.
- Malicious ELF payloads, including KrustyLoader, were downloaded from AWS S3 endpoints over HTTP using wget or cURL.
- Script payloads with .sh extensions were downloaded from an IP address identified in the article as a C2 endpoint.
- Some customer devices connected to pastebin[.]com and dpaste[.]com, which the article says may be used to retrieve malicious commands dynamically.
- Defensive Notes
- Maintain continuous extended visibility across environments.
- Use anomaly-based behavioral analysis and machine-speed intervention.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | 0d8da2d1[.]digimg[.]store | Listed as a C2 endpoint. |
| HOSTNAME | fconnect[.]s3[.]amazonaws[.]com | Listed as a C2 endpoint; associated with delivery of a KrustyLoader-linked ELF file. |
| HOSTNAME | tnegadge[.]s3[.]amazonaws[.]com | Listed as a C2 endpoint; associated with delivery of a KrustyLoader-linked ELF file. |
| HOSTNAME | trkbucket[.]s3[.]amazonaws[.]com | Listed as a C2 endpoint. |
| IPV4 | 134[.]209[.]107[.]209 | Listed as a C2 endpoint. |
| IPV4 | 15[.]188[.]246[.]198 | Listed as a C2 endpoint and observed serving a script payload. |
| IPV4 | 185[.]193[.]125[.]65 | Listed as a C2 endpoint. |
| IPV4 | 64[.]52[.]80[.]21 | Listed as a C2 endpoint. |
| MD5 | 4abfaeadcd5ab5f2c3acfac6454d1176 | Listed as a payload file hash. |
| MD5 | d8d6fe1a268374088fb6a5dc7e5cbb54 | Listed as a payload file hash. |
| SHA1 | 1dec9191606f8fc86e4ae4fdf07f09822f8a94f2 | SHA1 hash of an ELF file linked to KrustyLoader. |
| SHA1 | c47abdb1651f9f6d96d34313872e68fb132f39f5 | SHA1 hash of an ELF payload linked to KrustyLoader. |
MITRE ATT&CK
CVE
CVE-2023-46805Secure systems back in January 2024 when the zero-day critical vulnerabilities; CVE-2024-21887 and CVE-2023-46805 [10].CVE-2024-21887Ivanti Connect Secure systems back in January 2024 when the zero-day critical vulnerabilities; CVE-2024-21887 and CVE-2023-46805 [10].CVE-2025-0282and Policy Secure (PS) vulnerabilities CVE-2023-46805 and CVE-2024-21887 in early 2024, as well as CVE-2025-0282 and CVE-2025-0283, which affected CS, PS, and Zero Trust Access (ZTA) in January 2025.CVE-2025-0283(PS) vulnerabilities CVE-2023-46805 and CVE-2024-21887 in early 2024, as well as CVE-2025-0282 and CVE-2025-0283, which affected CS, PS, and Zero Trust Access (ZTA) in January 2025.CVE-2025-31324were also made to an IP address associated with infrastructure linked to SAP NetWeaver vulnerability CVE-2025-31324, which has been investigated by Darktrace in an earlier case.CVE-2025-4427therefore, it was no surprise that recent Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities CVE-2025-4427 and CVE-2025-4428 were exploited targeting organizations in critical sectors such as healthcare,CVE-2025-4428was no surprise that recent Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities CVE-2025-4427 and CVE-2025-4428 were exploited targeting organizations in critical sectors such as healthcare, telecommunications, and
People
Threat Actors
Malware
Vendors
Products
Darktrace / NETWORKsuch as those found in Ivanti EPMM and investigated across customer environments with Darktrace / NETWORK, have become a key tool in the arsenal of attackers in today’s threat landscape. As highlighted inIvanti Connect SecureKrustyLoader is a Rust based malware that was discovered being downloaded in compromised Ivanti Connect Secure systems back in January 2024 when the zero-day critical vulnerabilities; CVE-2024-21887 andIvanti Endpoint Manager Mobile (EPMM)to prevail in today’s cyber threat landscape; therefore, it was no surprise that recent Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities CVE-2025-4427 and CVE-2025-4428 were exploited targeting organizations inPolicy Securein the exploitation of earlier Ivanti vulnerabilities—specifically Ivanti Connect Secure (CS) and Policy Secure (PS) vulnerabilities CVE-2023-46805 and CVE-2024-21887 in early 2024, as well as CVE-2025-0282 andZero Trust Access (ZTA)in early 2024, as well as CVE-2025-0282 and CVE-2025-0283, which affected CS, PS, and Zero Trust Access (ZTA) in January 2025.
Tools
curlof DNS requests and connections, most of which featured a user agent associated with the command-line tool cURL, directed toward associated endpoints. The hostnames of these endpoints consisted of a string of randomlywgetendpoints like 's3[.]amazonaws[.]com'. These downloads occurred over HTTP connections, typically using wget or cURL user agents. Some of the ELF files were later identified to be KrustyLoader payloads using
Industries
financewere exploited targeting organizations in critical sectors such as healthcare, telecommunications, and finance across the globe, including across the Darktrace customer base in May 2025.HealthcareCVE-2025-4427 and CVE-2025-4428 were exploited targeting organizations in critical sectors such as healthcare, telecommunications, and finance across the globe, including across the Darktrace customer base in MayTelecommunicationsand CVE-2025-4428 were exploited targeting organizations in critical sectors such as healthcare, telecommunications, and finance across the globe, including across the Darktrace customer base in May 2025.