Norwegian Entities Targeted in Ongoing Attacks Exploiting Ivanti EPMM Vulnerability

Superior persistent threat (APT) actors exploited a recently disclosed critical flaw impacting Ivanti Endpoint Manager Cell (EPMM) as a zero-day considering that at least April 2023 in assaults directed in opposition to Norwegian entities, together with a govt network.

The disclosure arrives as aspect of a new joint advisory launched by the Cybersecurity and Infrastructure Security Company (CISA) and the Norwegian Nationwide Cyber Security Centre (NCSC-NO) Tuesday. The specific identity or origin of the threat actor stays unclear.

“The APT actors have exploited CVE-2023-35078 given that at the very least April 2023,” the authorities reported. “The actors leveraged compromised compact place of work/house workplace (SOHO) routers, like ASUS routers, to proxy to focus on infrastructure.’

CVE-2023-35078 refers to a extreme flaw that permits menace actors to entry individually identifiable details (PII) and get the capability to make configuration adjustments on compromised techniques. It can be chained with a next vulnerability, CVE-2023-35081, to cause unintended consequences on specific units.

Thriving exploitation of the twin vulnerabilities makes it feasible for adversaries with EPMM administrator privileges to compose arbitrary documents, these kinds of as web shells, with running process privileges of the EPMM web software server.

The attackers have also been observed tunneling targeted visitors from the internet by Ivanti Sentry, an application gateway appliance that supports EPMM, to at minimum just one Trade server that was not available from the internet, while it truly is presently unidentified how this was completed.

Further assessment has disclosed the presence of a WAR file identified as “mi.war” on Ivanti Sentry, which has been described as a malicious Tomcat software that deletes log entries primarily based on a precise string – “Firefox/107.” – contained in a textual content file.

“The APT actors applied Linux and Windows consumer agents with Firefox/107. to connect with EPMM,” the agencies said. “Cellular gadget administration (MDM) techniques are eye-catching targets for threat actors since they offer elevated obtain to 1000’s of cell equipment.”

A vast majority of the 5,500 EPMM servers on the internet are situated in Germany, followed by the U.S., the U.K., France, Switzerland, the Netherlands, Hong Kong, Austria, China, and Sweden, in accordance to Palo Alto Networks Device 42.

To mitigate versus the ongoing risk, it is advised that corporations implement the most up-to-date patches as before long as probable, mandate phishing-resistant multi-variable authentication (MFA) for all team and expert services, and validate security controls to examination their success.

Discovered this posting appealing? Stick to us on Twitter  and LinkedIn to go through additional special articles we put up.

Some parts of this article are sourced from:
thehackernews.com