# APT actors exploit Ivanti EPMM zero-day since April

Published: 2025-07-17 · Severity: high · Sectors: government-national
Canonical: https://vorant.io/reports/b943758e-f217-5807-b1ff-befcc8a73b09/apt-actors-exploit-ivanti-epmm-zero-day-since-april

> APT actors exploited Ivanti EPMM authentication bypass CVE-2023-35078 as zero-day from April through July 2023 to target Norwegian government and organizations.

APT actors exploited CVE-2023-35078, a critical authentication bypass in Ivanti Endpoint Manager Mobile (EPMM, formerly MobileIron Core), as a zero-day from at least April 2023 through July 2023. The vulnerability allows unauthenticated access to specific API paths, enabling attackers to retrieve personally identifiable information (PII), make configuration changes, push packages to mobile endpoints, and access GPS data. Ivanti released a patch on July 23, 2023. The actors later chained this with CVE-2023-35081, a directory traversal flaw enabling arbitrary file write with EPMM web server privileges, to upload and execute webshells. Ivanti patched CVE-2023-35081 on July 28, 2023.

NCCS-NO investigation revealed the APT actors routed traffic through compromised ASUS routers, performed LDAP queries against Active Directory, enumerated users and administrators, accessed audit logs, and tunneled traffic through Ivanti Sentry appliances to reach internal Exchange servers. The actors deployed webshells at OWA logon/logoff paths and deleted Apache httpd log entries using a malicious Tomcat application called mi.war. Mobile device management systems are high-value targets providing elevated access to thousands of mobile devices. CISA added both CVEs to its Known Exploited Vulnerabilities Catalog in late July 2023.

## Mentioned in this report

- Vulnerabilities: CVE-2023-35078 (KEV), CVE-2023-35081 (KEV)
- Malware: mi.war

## Detection guidance (public sample)

### Unauthenticated Access to Ivanti EPMM Core API Paths

ATT&CK: T1190

Detects successful requests to the EPMM /mifs/aad/api/v2/ API paths that are reachable without authentication, the access pattern used to exploit CVE-2023-35078 and chained with CVE-2023-35081. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Unauthenticated Access to Ivanti EPMM Core API Paths
description: Detects successful HTTP requests to the Ivanti EPMM (MobileIron Core)
  /mifs/aad/api/v2/ API paths, which CVE-2023-35078 exposed without authentication
  for PII retrieval and configuration changes. Review the source address; requests
  from outside admin or management ranges are suspicious. Unpatched servers are the
  target.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: /mifs/aad/api/v2/
    sc-status: 200
  condition: selection
falsepositives:
- Legitimate EPMM administrators or integrations calling these API paths from known
  management hosts
- Authorised vulnerability scanners testing for CVE-2023-35078
level: high
id: 704f87c2-0517-53e8-8630-c729c099252b
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a
```

### Java Tomcat Process Spawning Shell for Recon or LDAP Enumeration

ATT&CK: T1505.003

Detects a Java (Tomcat) process on a Linux appliance spawning a shell that runs discovery, LDAP query or download commands, consistent with webshell activity on EPMM. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Java Tomcat Process Spawning Shell for Recon or LDAP Enumeration
description: Detects a Java parent process (such as Tomcat hosting EPMM) spawning
  sh or bash with discovery, LDAP enumeration or download commands. This is typical
  of webshell use after exploitation of CVE-2023-35078 and CVE-2023-35081, including
  AD user and admin enumeration from the appliance.
tags:
- attack.persistence
- attack.t1505.003
- attack.discovery
- attack.t1087.002
- attack.t1018
- attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /java
    Image|endswith:
    - /sh
    - /bash
  selection_cmd:
    CommandLine|contains:
    - ldapsearch
    - whoami
    - /etc/passwd
    - uname -a
    - ifconfig
    - 'curl '
    - 'wget '
  condition: selection_parent and selection_cmd
falsepositives:
- Vendor maintenance or health-check scripts launched from the Java application
- Administrators running diagnostic scripts through the application console
level: medium
id: ddd61c24-d6b7-56a2-92f0-39aa7bafbb21
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a
```

### WAR File Written to Tomcat Webapps Directory by Non-Package Process

ATT&CK: T1505.003

Detects creation of .war files in a Tomcat webapps directory by anything other than package managers, as when a malicious application such as mi.war is deployed to tamper with logs or host a webshell. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WAR File Written to Tomcat Webapps Directory by Non-Package Process
description: Detects a .war archive written under a webapps directory on a Linux server
  outside package-manager activity. Attackers who exploited Ivanti EPMM deployed a
  malicious Tomcat application (mi.war) that removed Apache httpd log entries. This
  rule matches the deployment pattern rather than the file name.
tags:
- attack.persistence
- attack.t1505.003
- attack.stealth
- attack.t1070
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains: /webapps/
    TargetFilename|endswith: .war
  filter_pkg:
    Image|endswith:
    - /rpm
    - /dpkg
    - /yum
    - /dnf
    - /apt
  condition: selection and not filter_pkg
falsepositives:
- Planned application deployments or EPMM upgrades performed by administrators
- Configuration management tooling that deploys WAR files
level: medium
id: 8af54404-d879-5e42-9307-0d3507bead78
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b943758e-f217-5807-b1ff-befcc8a73b09/apt-actors-exploit-ivanti-epmm-zero-day-since-april.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup