Ransomware

Threat Actors Exploiting Ivanti EPMM Vulnerabilities

Official source

EudorIA operational summary

What it means

Priority 95/100

CISA Cybersecurity Advisories ha pubblicato un advisory sul ransomware Threat Actors Exploiting Ivanti EPMM Vulnerabilities. La fonte descrive vulnerabilita o tecniche gia osservate in attacchi e richiede una verifica prioritaria.

Why it matters

L'advisory descrive attivita ransomware osservate e misure difensive pubblicate da un'autorita. Non prova che il proprio perimetro sia compromesso, ma richiede una verifica prioritaria di esposizione e controlli.

Recommended actions

Verificare e correggere con priorita i sistemi Internet-facing indicati dalla fonte; applicare MFA resistente al phishing, segmentazione e backup offline immutabili con prove di ripristino.
Verificare sistemi esposti, accessi remoti e versioni rispetto all'advisory ufficiale.
Confermare che backup offline e immutabili siano separati e ripristinabili.
Correlare TTP e IOC pubblicati con la telemetria autorizzata del proprio perimetro.

Potential operational benefits

Prioritizzazione delle esposizioni Internet e delle vulnerabilita sfruttate
Verifica dei controlli su accessi remoti, movimento laterale ed esfiltrazione
Validazione documentata della capacita di ripristino

Indications to confirm against the customer's technical and organisational perimeter.

Relevant controlsVulnerability managementIdentity and access managementNetwork segmentationBackup and recoveryDetection and response

AudienceITSOCCISOManagement

Information centre

Translation in progress

CISA

The official content is available in the original language. The Italian version will be published once automated checks are complete.

Text acquired from the source

Cybersecurity Advisory Threat Actors Exploiting Ivanti EPMM Vulnerabilities Release Date August 01, 2023 Alert Code AA23-213A Related topics: Securing Networks , Cyber Threats and Response SUMMARY The Cybersecurity and Infrastructure Security Agency (CISA) and the Norwegian National Cyber Security Centre (NCSC-NO) are releasing this joint Cybersecurity Advisory (CSA) in response to active exploitation of CVE-2023-35078 and CVE-2023-35081. Advanced persistent threat (APT) actors exploited CVE-2023-35078 as a zero day from at least April 2023 through July 2023 to gather information from several Norwegian organizations, as well as to gain access to and compromise a Norwegian government agency’s network. Ivanti released a patch for CVE-2023-35078 on July 23, 2023. Ivanti later determined actors could use CVE-2023-35078 in conjunction with another vulnerability CVE-2023-35081 and released a patch for the second vulnerability on July 28, 2023. NCSC-NO observed possible vulnerability chaining of CVE-2023-35081 and CVE-2023-35078. CVE-2023-35078 is a critical vulnerability affecting Ivanti Endpoint Manager Mobile (EPMM) (formerly known as MobileIron Core). The vulnerability allows threat actors to access personally identifiable information (PII) and gain the ability to make configuration changes on compromised systems. CVE-2023-35081 enables actors with EPMM administrator privileges to write arbitrary files with the operating system privileges of the EPMM web application server. Threat actors can chain these vulnerabilities to gain initial, privileged access to EPMM systems and execute uploaded files, such as webshells. Mobile device management (MDM) systems are attractive targets for threat actors because they provide elevated access to thousands of mobile devices, and APT act

Indicatori CISA verificabili

266 valori IOC dalla fonte ufficiale. Non sono una lista di blocco automatica: verificare data, contesto e applicabilita.

Copertura parziale: sono mostrati solo gli indicatori verificati e interpretabili. 1 allegati richiedono ancora verifica o un formato supportato.

Ultima verifica: 2026-09-26T07:02:08.386584+00:00

Scarica STIX 2.1

Tipo	Indicatore (non cliccabile)	File
mutex	`FEBBA89B4B9A9649B3A3BF41C4C7D853`
mutex	`FE9DE1CDD645971C5D15EE1873C3FF8D`
mutex	`FE6E7FAC4F0B4F25D215E28CA8A22957`
mutex	`FDFF2BF247A7DAD40BAC228853D5A661`
mutex	`FA4F1A3B215888BC5F19B9F91BA37519`
mutex	`F9D5CC0CBAE77EA1A371131F62662B6B`
mutex	`F967460F8C6DE1CEDB180C90C98BFE98`
mutex	`F8D6F89AECF792E844E72015C9F27C95`
mutex	`F8BCC8F99A3AFDE66D7F5AFB5D8F1B43`
mutex	`F804388F302AF1F999E4664543C885A1`
mutex	`F4DD9BB28D680A3368136FB3755E7EA9`
mutex	`F3D751B0585855077B46DFCE226CFEA1`
mutex	`F20FBFD508E24D50522EADF0186B03EB`
mutex	`F0776DFE17867709FDB0E0183ED71698`
mutex	`F05A5A60AD6F92D6F28FA4F13DED952F`
mutex	`EF4C4D79F02AC404F47513D3A73E20C7`
mutex	`EF35374F4146B3532F0902D6F7F0EF8C`
mutex	`ED82A50D98700179C8AE70429457477A`
mutex	`EB277D809A59D39D02605C0EDD9333E9`
mutex	`EA6BD3DB104CA210B5AD947D46134AAF`
mutex	`E99CFFA2AFA064625F09E1C5ACA8F961`
mutex	`E82B7AD2C05F4617EFBC86A78C1E61E9`
mutex	`E54329351788661F2A8D4677A759FC42`
mutex	`E3C642432A815A07F035E01308AAA8FC`
mutex	`E1F579227327EBB21CDE3F9E7511DB01`
mutex	`DDDFBAE77336120FEBD5AD690AF3E341`
mutex	`DC9E6EDEB7557BC80BE68BE15CEBB77A`
mutex	`DC26EF761C7EC40591B1FE6E561B521D`
mutex	`DBB293176747FA1C2E03CBC09433F236`
mutex	`DAEE31D7CC6E08EAD6AFAD2175989E1D`
mutex	`D966C6C822122E96F6E9F5F1D4778391`
mutex	`D92E87D2689957765987E2BE732D728E`
mutex	`D711D577B9943AB4E2F8A2E06BB963E3`
mutex	`D662D20507BEBC37B99A4D413AFA2752`
mutex	`D485A1B5DB2F97DC56500376D677AA89`
mutex	`D3D72F4C7038F7313AD0570E16C293BF`
mutex	`D3CFEE76468A9556FD9D017C1C8EE028`
mutex	`D2CEA317778AD6412C458A8A33B964FD`
mutex	`D255291BB8E460626CB906EBACC670E5`
mutex	`D173076D97A0400A56C81089912B9218`
mutex	`D131F17689F1F585E9BFDCDB72A626BB`
mutex	`D12D98A0877F6E3C8B5A59F41CC4DE9B`
mutex	`CEEF2E728DB1B5AE15432F844EEB66E1`
mutex	`CE0DD163D9E02BFD42D61024523CB134`
mutex	`CD1312BE032256A10CF866AF3E9AFAE9`
mutex	`CCDDDB69E9344A039C4AC9C49A6F2D7B`
mutex	`CCB15EEF4287C8EFA472915BCB4EC458`
mutex	`CBEEB123EFE8CF7F842426B673415C28`
mutex	`CBCD728A2350712B5747CD3447473DEB`
mutex	`C9C16287CBBE5A037244E374BA84AECC`
mutex	`C986C7BF720CE1463C3D628D2B3DAD01`
mutex	`C66F36EB180438882133717C3ABB5157`
mutex	`C262A39F49604F05A5656213F758CD46`
mutex	`C17B3EC40ED5216E44311138AAFAEA2C`
mutex	`C0A2FD066C955137036F92DA2C3A3FF1`
mutex	`C013F308D170AA2ECA4A5B0F0BBD3CCB`
mutex	`BE1F24457141D80206BC2E58F55DC879`
mutex	`BCF75736D176394F3DF69F3E0EF7DD9F`
mutex	`BCD62F3E029F96F62C24D50D2D1402AC`
mutex	`BA4A616C8D4AB9358A82B321D8E618BF`
mutex	`B9ECB08402DF0F1F6E1CE76B8AD6E91F`
mutex	`B956ED2B848DABB4E79AB7358233861B`
mutex	`B8F6B0D234A305C25411E83FD430C624`
mutex	`B8366AAA5ED51C0DEA3FC90EF7E14889`
mutex	`B79434613820FAF30D58F103C4415A29`
mutex	`B57F3E41C03803306B0EE2111F7EF823`
mutex	`B53F179B3F25F72BB0C7CCF45BF8BEEE`
mutex	`B50666C9AED1C2F222C56B6E9B326D27`
mutex	`B4F31423445B5F13675F205AC997F41F`
mutex	`B311AB82B30F41B12CB9089D00C4A1FF`
mutex	`AF06C3E72F2F307515BA549174D8E5A6`
mutex	`AEF0172A2C03F77912DE0BBF14AEE00F`
mutex	`AA2FE3A253E169B05E1782CA57A688D2`
mutex	`A98CF0A359F430A00F4F3D522F5B6CC0`
mutex	`A96837FE533247ABB7F88000D0216A50`
mutex	`A89DF6156EB5A2DE196388D4A123B470`
mutex	`A80B6A354B493264F37AA39D0D41B5FC`
mutex	`A596EBBCF438980C880D711315E4FDF1`
mutex	`A4F11B1EB659869A0AE70898A4A0E5EE`
mutex	`A260D836428CDB971BDF147CA6940160`
mutex	`A1B732A9AF792F75A68ED78D72FFB8F6`
mutex	`9FDD7A85B3A4EF8DED73BEB3E6218109`
mutex	`9F3BF94572344B36F6EF1689CB30C66E`
mutex	`9F2438AAAB4744C4B7B5B7287A783099`
mutex	`9EC17429EED5446E3720796AB50D8C60`
mutex	`9E5613533972A9D42D2E3344A4E58566`
mutex	`9DF128EBE0C82064AA746647883112C9`
mutex	`9D74D395BD2F72A47A5C980E6040DF5A`
mutex	`9CFDA02EF7E04C469B77F8197A249C17`
mutex	`9BA21C5148913186A5BF877078CBC048`
mutex	`9A176D818EDFF838FC057CEA3EE372C0`
mutex	`9980FEBFAF901D4113A1C473F79D7EB6`
mutex	`984C4653A563B19C87F264611A6ADC01`
mutex	`96C41E4C4A1812187FB279B9299AD63B`
mutex	`9622902CC43F4A20D0D686A37E4D8232`
mutex	`9610328CDAA4694800C2C93410F8CE82`
mutex	`95588E0386206FA02912CFCAF18C1220`
mutex	`934A8A6528E91CAA019ACB76E791A71D`
mutex	`9253399537FAD8448F1D4732DD79F6FA`
mutex	`922A3272AAD17C9EAAD733696A4321DA`
mutex	`918DFAB0333AE15D61F14FD24B5EAAAC`
mutex	`9188EF45EA917A91EC9B92B5DD8CD90D`
mutex	`905967B08BD44CFA60D969229921AC23`
mutex	`8FAFA73E9985E05D0C1C964DA770C567`
mutex	`8D5515351AFDF27B013F96A05BF45147`
mutex	`8BB1781E756A53CD00D9B2EC670FA21E`
mutex	`8B297F8B219E968932293EE7A8242CA3`
mutex	`8B0AE9029974091DF12210255AAECAD6`
mutex	`8AD0FD4B78C89BD63B97343FDA1EECCB`
mutex	`8A6B0BA3496EECA39D6D3F9BAE830C90`
mutex	`883B9FE16E45C388968DEFC73A5FBA7A`
mutex	`85C3FAC6A9885362C448F434671E362F`
mutex	`84301B967A4D9A242466C04901BAD691`
mutex	`840F488B7C0A5D686D1E89908735F354`
mutex	`833D3201066F5184C874C73A2083C448`
mutex	`830838CB0620D659405A74401CD72557`
mutex	`821F649D08687E22F96CEA99FBB5D3A3`
mutex	`8207129585DA68066ED08E94216D76EE`
mutex	`819030799F0020ED724C2EF3FFAA56C6`
mutex	`80BD0F3610F6C4D60584A5BE0B8A3016`
mutex	`802F5D34C230DA40C0912A1C5A9B702B`
mutex	`7E3630C67C802EABB67B108AD4D7DED7`
mutex	`7CD727171C2522F51417EDEEBA4F1791`
mutex	`7CBC7459DB5327C26476549F225030F5`
mutex	`7B9DB1D58326C1FA276BA2A39BCC2617`
mutex	`7B4137B4E85F31A81BB5BAFEDA993947`
mutex	`79C6D12D168B85437384B20EB94E106B`
mutex	`78988C65E9B70E7929E747408D8F0B0E`
mutex	`77A01363FA2B29AF25C004DA9570E23C`
mutex	`76C0D09FED2F33BABB0DE8EE2C07144C`
mutex	`75E874D8E0A79697633B87EA5E798B1C`
mutex	`74CF24F2A66A31C88B6FCFE01F12160C`
mutex	`74871691EAC48156CE0DA2CFA3AB401A`
mutex	`7292EF4CDCA529071FAD97496E1C9439`
mutex	`719EC5DA8F2153A436EE8567FF609894`
mutex	`708140C311D3D69418F75C928E7535A0`
mutex	`706B6055658AFF067AE370F23831EF6B`
mutex	`6FB8CDF567DD7D89D53B5771D769CB5F`
mutex	`6F1FA8B444CAF0D8238F948279CA74E1`
mutex	`6EAD0D5D3F87911C27F3AE0A75E6B5BC`
mutex	`6E3650528F719FC50988A1F697644832`
mutex	`6E359F3BBC622E9B1ED36F6E3D521BCF`
mutex	`69ECF52960C8BD9E746DFE9EE19C11F6`
mutex	`692F91C0C5E9E93E0A24BD3392887CA1`
mutex	`689385F1218E0D4C347595648CA6A776`
mutex	`67A42E2E27FFC26D1F3D0CEB8384AFD0`
mutex	`66F6A192083A7AB00AE8E0B5CC52E8F4`
mutex	`65EEF0A0EE257254EF0418AA57192CFB`
mutex	`646973D1928C401BA80961C12CBF84A2`
mutex	`6441640409815CFB4BF469E685E1BDB5`
mutex	`63FC58BE0D7B48EAA34DA7F752AE8AE6`
mutex	`635755DADFAB8B92FB502AAFB09122DB`
mutex	`634296A023280D020674C873D0199760`
mutex	`62AC194F2526EB45485526BCA35C8F43`
mutex	`61DEE38D2F97220EFB1218AD8971E3AB`
mutex	`6088C2A04C94CDCD5A283A6D1622FFBA`
mutex	`6010282004917ECF3900BABF61456432`
mutex	`5F4D5965AF741BBA59B7C8D3425F33DD`
mutex	`5E35F50C692081FD6C7DDAC1272E2D6C`
mutex	`5D55026FB84DBA91AC01E2095504B1BC`
mutex	`5D0259CA16CFC2D7D1B0FAC69F29AB05`
mutex	`59FAF75430E9326D3AE9D231BB3AE8C6`
mutex	`59EEC218522CC5C7743A0D37892A3345`
mutex	`59401C9A60449C742D073D93D1B7039A`
mutex	`58BC21D305A65C41745327F142F3AC12`
mutex	`588D0B42E54174A98E1ECA59945E8B32`
mutex	`555389E92C622B87D3FC395FD8723501`
mutex	`549CDE6535A884126755FC53F59A820C`
mutex	`5466368D4659F1B1470BCB09E65B484D`
mutex	`539F1A5183800A96228458932F9307F7`
mutex	`5244B163F9326A1E5EAA8860F7543F99`
mutex	`4D34DB639BA84B11822FB3DAC47ED7D1`
mutex	`4C1B73EC52E6EEC0C5D20577FCBC9EF1`
mutex	`49D2BD08038DC7DADA221008591940F9`
mutex	`495C6FF7CA0379AD0891BAC47917D09A`
mutex	`4959A611B9885022D81B4BC8E4B1D149`
mutex	`49230C486F0FD383CD301FE162D6A786`
mutex	`4898A51256AE7D914A5FFD5695973470`
mutex	`476E72BBDA5B78D188766139889E3038`
mutex	`43C22DABB1E6D2449A39C2F7E974D537`
mutex	`41854ADBC73B0B58E5C566F60BB0DF25`
mutex	`404F56045E436D53EAD2177BF957BA39`
mutex	`403273B51F91CF3C333695E5532CB2C3`
mutex	`3DD13FAAD1C45EB0C23E4567210F7EAC`
mutex	`3BE529EB3A7DAAF34F963A22188F6139`
mutex	`3BD1BDB5E90B9590A8878BFF2ADA8204`
mutex	`3B30B4555CC8B4B164AD03CF322CBEA8`
mutex	`3B22AF324ABDED2781ED8F6A61F3654F`
mutex	`3962B622C5AA815AFB803B92AA948424`
mutex	`393662E5AA0CB49C5D666A6D10A1ADE6`
mutex	`391A4C2C7541B8B78E2F99BF586E9794`
mutex	`37D952966EA7E79277803F13D7147544`
mutex	`3744004013135B9F9A05CB58CDA8134D`
mutex	`3685ABC75517E61E47E52E5F2D060F54`
mutex	`361F47A6357CC6E3A9BCDD20CFAAF0E9`
mutex	`34D92552E278710C1E84F0BD8DC3A6B8`
mutex	`34AC9A6EF5D285119ABEC50FBE41FCFE`
mutex	`32775EAD3EA1AD7DB2F4BEA67FE0CABB`
mutex	`3268A5097A543C7DBD82C39A9193B7FE`
mutex	`30BE84E6B95F44C203F8E7FCE7339A8E`
mutex	`30A9F568EB3DF79352FC587A078623B6`
mutex	`309D33C6F77A3FC75654C44C61596CCD`
mutex	`3082E669DDA9D023E2DCD8B9549A84A8`
mutex	`3003024AFE64B4E8A5A30825C14BBB12`
mutex	`2EBC7FDCEAA9A0DF556E989D77157006`
mutex	`2BEECB6B9E386F29D568229A9953C3D2`
mutex	`2AA8BA7478B1362274666D714DF575BC`
mutex	`289A450C7478DD52A10C6ED2FB47F7E9`
mutex	`276E175D4FE8454C4C47E966D8CB3FA3`
mutex	`253FD4659BF21BE116858BC0F206C5B9`
mutex	`23E3E6FA8B23D9BC19E82DE4E64C79E9`
mutex	`22CC1B3BC9F99D3A520AE58FEE79A0D5`
mutex	`206FED3A39D9215C35395663F5BB3307`
mutex	`1EC71612E438CF902913EEC993475EB9`
mutex	`1E0850E10A00C9BBDD5C582FF4CB6833`
mutex	`1B7D9368C6CE7623FDBC43F013626535`
mutex	`1B6720ED0B67C910A80722CE973D6217`
mutex	`1ABFDEAADB74A0F7C461E7BAB157B17F`
mutex	`1AA7DAE8F2AE0A29402ED51819F82DB4`
mutex	`1A024E63721C610D2E54E67D62CD5460`
mutex	`19F51486ABD40C9F0FC0503559A6C523`
mutex	`188623FDD056C4ED13D1FF34C7377637`
mutex	`16A74FC216F8A4CE43466BB83B6D3FD2`
mutex	`1660F3D882A4311CA013EE4586E01FD9`
mutex	`15A074A397727B26A846B443B99C20FF`
mutex	`151BC875DF15D1385E6EB02F9EDABA06`
mutex	`14994353F3EA6FD25952A8C7D57F9ECF`
mutex	`146CAF9BD0153428F54E9EF472154983`
mutex	`14671C3F8DECA7D73A03B74CB854C21D`
mutex	`1336DF27F94B25A25ACAC9DB3E61E461`
mutex	`11C506D5E3FB7E119C4287202C96A930`
mutex	`119F8C9050D1499B6F958B857868B8CE`
mutex	`0F6E78839398C245D13F696A3216D840`
mutex	`0E1FAD8FFAA7A939F0A6CBF9CD7E2FCD`
mutex	`0DA24834056873A8CD8311000088E8BE`
mutex	`0CB0380CF75A863B3E40A0955B1ADA9F`
mutex	`0B8E1211DE50D244B89E6C1B366D3CCF`
mutex	`0B28842D64A344C287E6165647F3B3FE`
mutex	`09DF72C01A1A0AD193E2FFF8E454C9C4`
mutex	`07A624D7236CCA3934CF1F8E44B74B52`
mutex	`070F9FE9F0EC69E6B8791D280FDE6A48`
mutex	`04E7F5787F89A597001B50A37B9F8078`
mutex	`045F8CCDAC6D4E769B30DA406808DA71`
mutex	`03F8852448A85E14F2B4362194160C32`
mutex	`02BE3B93640437DBBA47CC7ED5AB7895`
mutex	`0212A88C7ED149FEBDEFA347C610B248`
mutex	`01ECD9AB9BE75E832C83C082BE3BDF18`
mutex	`00E872019B976E69A874EE7433038754`
mutex	`0092CE298A1D451FBE93DC4237053A96`
mutex	`EB5FDC72F0A76657DC6EA233190C4E1C`
mutex	`E84A32D43DB750B206CB6BEED08281D0`
mutex	`E669667EFB41C36F714C309243F41CA7`
MD5	`e60dc8370ecf78cf115162fbc257baf5`
MD5	`ad55557b7cbd735c2627f7ebb3b3d493`
mutex	`8D9F7747675E24454CD9B7ED35C58707`
mutex	`849D3331F3E07A0797A02F12A6A82AA9`
mutex	`473CD7CB9FAA642487833865D516E578`
mutex	`2D5BD942EBF308DF61E1572861D146F6`
MD5	`1c8e55823e415fabeffca526aa285072`
SHA-1	`1cd358d28b626b7a23b9fd4944e29077c265db46`
SHA-256	`6255c75e2e52d779da39367e7a7d4b8d1b3c9c61321361952dcc05819251a127`
SSDEEP	`96:hv3jaMVQoJ08mSr4ANreokFiFek3RDIkeK97NOHMVgFtjk6txfJ:hXVQwfr4AhzukhDIkJxO0gF+cxh`
SHA-1	`c0b42bbd06d6e25dfe8faebd735944714b421388`
mutex	`579CCEF312D18482FC42E2B822CA2430`
MD5	`e1d8b04eeb8ef3954ec4f49267a783ef`
MD5	`cd08e31494f9531f560d64c695473da9`

Provenance

Allegato ufficiale CISA · 2023-08-02T14:27:43Z

SHA-512: ebfa55e0d1f673c9d2353eb5951877dc203b9846c4d989c5f174eb1e81f11475c85afe33ba502ecc0698a5402fd9b62bb21a77d6c96391bc1bc339950ca50401

Source: CISA Cybersecurity Advisories
Publishing entity: CISA
Entity type: National authority
Area: North America · US
Original language: en · translation in preparation
Publication: 01/08/2023 14:00
Sharing: TLP:CLEAR
MITRE ATT&CK: T1001, T1001.003, T1005, T1018, T1021.001, T1027, T1036.005, T1057, T1059, T1059.001, T1068, T1070, T1070.001, T1087, T1087.002, T1090, T1090.001, T1190, T1213, T1505, T1505.003, T1572, T1584, T1584.005, T1595, T1595.002
CVE: CVE-2023-35078, CVE-2023-35081, CVE-2023-30578
Classification: Critical
Stated country: US

Technical scope

Affected products and versions

Verification in progress

Information not yet acquired.

The collector will check NVD and the available official vendor advisories.

Action indicated by the source

Verificare e correggere con priorita i sistemi Internet-facing indicati dalla fonte; applicare MFA resistente al phishing, segmentazione e backup offline immutabili con prove di ripristino.

Official technical references

Open the original source