Nation-State Hackers Exploit Ivanti EPMM Flaw to Breach Government Networks

The Anatomy of the Ivanti EPMM Vulnerability

In the summer of 2023, a critical zero-day vulnerability emerged in Ivanti’s Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core. This mobile device management (MDM) platform is widely used by governments, financial institutions, and critical infrastructure sectors to secure and manage mobile fleets. The flaw, designated CVE-2023-35078, represented an authentication bypass that enabled unauthenticated, remote attackers to gain administrative control over the EPMM server. With a CVSS score of 10.0—the highest severity rating—the vulnerability allowed access to personally identifiable information (PII) of users, device configurations, and the ability to push malicious applications or profiles to managed devices. Within days of its disclosure, a second vulnerability, CVE-2023-35081, a path traversal flaw enabling arbitrary file writes, was actively exploited in chained attacks, further escalating the threat.

Security researchers quickly identified that CVE-2023-35078 resided in the EPMM web application’s REST API endpoints. The flaw stemmed from insecure handling of HTTP request headers, specifically a manipulation of the If-Modified-Since header or, in some variations, a forged authentication token logic. An attacker merely needed to send a carefully crafted request to the /mifs/aad/api/v2/ endpoint to obtain admin-level session tokens without any credential validation. This token could then be used to extract sensitive data, create backdoor accounts, and execute remote commands. The attack surface was alarmingly wide — public internet-facing EPMM instances, often deployed without additional network layer protections, became immediate targets for opportunistic and state-sponsored threat actors alike.

Discovery and Initial Exploitation

The timeline of exploitation began well before the official disclosure by Ivanti on July 23, 2023. Norwegian cybersecurity authorities and the Norwegian National Security Authority (NSM) issued an urgent advisory on July 24, confirming that the vulnerability had been used to compromise the ICT platform used by twelve Norwegian government ministries. The attack vector was traced back to a vulnerable EPMM server operated by a third-party IT service provider, creating a devastating supply chain cascatde into core government systems. Norway’s Data Protection Authority was also notified, underscoring the severity of the data exposure.

Mandiant and other threat intelligence firms attributed the initial exploitation to UNC5221, a suspected China-nexus espionage group, though some forensic markers overlapped with tactics used by APT31 and other state-aligned clusters. The attackers had weaponized the vulnerability at least since early July 2023, conducting reconnaissance and data exfiltration operations methodically. The Norwegian incident served as a global wake-up call, but within hours, Ivanti was forced to release a patch for CVE-2023-35081, a separate vulnerability uncovered during post-exploitation forensic audits by affected organizations. This second flaw permitted authenticated actors to write arbitrary files to the server, enabling web shell deployment and persistent backdoor access.

Nation-State Tactics, Techniques, and Procedures

The attack chain demonstrated by the nation-state adversaries followed a measured, multi-phase intrusion pattern. Initial access was achieved by exploiting CVE-2023-35078 through a minimal, single-packet HTTP request. The stolen administrator cookie or token allowed immediate enrollment of attacker-controlled devices into the MDM infrastructure. From there, the threat actors moved laterally by pushing silent, signed configuration profiles containing malicious VPN settings or root certificate installations to high-value targets’ mobile phones. This enabled man-in-the-middle interception of encrypted communications, including SMS-based multi-factor authentication tokens, effectively defeating network security boundaries.

Post-compromise activity included querying the EPMM database for user directories, extracting email addresses, phone numbers, device IMEI details, and geolocation histories. The attackers then exploited CVE-2023-35081 to upload a lightweight web shell — typically a JSP or PHP stager — disguised as a legitimate Ivanti application file. By navigating to the web shell’s URL, they performed interactive command execution, deepened their foothold, and established covert command-and-control (C2) channels using TLS-encrypted traffic camouflaged as Ivanti telemetry. Sophisticated operational security was evident: log wiping, use of rare user-agent strings, and activity limited to business hours in the victim’s time zone to avoid detection by after-hours security monitoring.

Impact on Government Networks

The compromise extended well beyond Norway. In the following weeks, reports surfaced from the United States Cybersecurity and Infrastructure Security Agency (CISA), which added CVE-2023-35078 to its Known Exploited Vulnerabilities catalog and mandated federal civilian executive branch agencies to patch within days. Additional victim notifications from Ivanti and its Incident Response partners pointed to government entities in Southeast Asia, the Middle East, and Eastern Europe. In several cases, the targeted governments used EPMM to manage devices of diplomats, intelligence personnel, and military officers, making the breach a direct national security threat.

In one documented case, a European foreign ministry discovered that the attackers had secretly created a rogue MDM administrator account with a name mimicking a known contractor. This account had accessed sensitive diplomatic cables via compromised mobile email containers for over two weeks before being detected. In another instance, a national defense contractor’s subsidiary running an unpatched EPMM instance was breached as a stepping stone to the larger parent network, leading to the exfiltration of classified weapon-systems-related technical documents. The incidents highlighted how trust relationships in MDM platforms represent a critical single point of failure in modern government IT architectures.

Technical Deep Dive: The Exploit Mechanics

Dissecting the exploit reveals its simplicity and elegance. CVE-2023-35078 exploitation begins with a GET or POST request to the authentication URI:

GET /mifs/aad/api/v2/ping HTTP/1.1
Host: target-epmm.example.com
If-Modified-Since:

The manipulation of the header, combined with an empty Authorization field or a specially crafted referer, bypasses all server-side filters and returns an auth_token in the response. This token grants the ‘admin’ role without any password verification. The token can then be reused across all administrative functions.

CVE-2023-35081 exploits originate from a path traversal in the /mifs/rest/api/v2/upload/ endpoint. An authenticated session (even the one illegitimately obtained) can inject filename paths using ../ sequences, allowing the upload of files outside the intended directory. A typical attack payload:

POST /mifs/rest/api/v2/upload/ HTTP/1.1
Content-Disposition: form-data; name="file"; filename="../../opt/tomcat/webapps/ROOT/cmd.jsp"
Content-Type: application/x-java-jsp

The combination of these two CVEs meant that even after the primary authentication bypass was patched, attackers with a still-valid hijacked admin session could deploy persistent backdoors using the file write flaw, complicating remediation efforts.

Indicators of Compromise and Forensic Footprints

Organizations hunting for signs of compromise observed distinct markers. Network logs revealed a surge in outbound connections to IP addresses associated with known APT infrastructure, particularly within the ASN ranges of Chinese cloud providers. Unusually, the malicious traffic often exhibited a valid SSL certificate issued by a legitimate certificate authority, making it indistinguishable from normal Ivanti Cloud communication at first glance. On the host side, new admin accounts with names such as “svc_backup” or “epmm_support” appeared in the EPMM admin console audit logs, often created at odd hours but masked by time-zone-adjusted timestamps.

File integrity monitoring spotted modified JAR files and the presence of unknown Java Server Pages inside the webapp directory. The web shells frequently contained encoded routines that invoked the Runtime.getRuntime().exec() method to execute system commands. Memory forensics on affected servers also revealed the secret key used to encrypt device backups, implying that the attackers were able to decrypt historical mobile data snapshots. This indicates a deep understanding of Ivanti’s internal key management logic, a hallmark of nation-state tradecraft.

Mitigation and Hardening Strategies

Ivanti released patches for both vulnerabilities in rapid succession. For CVE-2023-35078, hotfix versions for EPMM 11.10, 11.9, and 11.8 were made available, with the patch strengthening server-side validation of the authorization token generation process. For CVE-2023-35081, input sanitization was applied to the file upload API to reject path traversal sequences. However, patching alone proved insufficient for already-compromised environments. The U.S. National Security Agency (NSA) and CISA jointly recommended a comprehensive hygiene procedure: full credential reset for all EPMM users, revocation of all active API keys, and re-imaging of any server where a web shell or unauthorized file write was confirmed.

Network-level mitigations included segmenting the MDM infrastructure from the rest of the enterprise, enforcing strict firewall rules to permit administrative access only from jump hosts, and monitoring all outbound traffic from EPMM servers to unknown external IPs. Application-layer solutions, such as deploying a Web Application Firewall with rules matching the specific exploit signatures, provided interim protection until patches could be tested and applied. Device-side, organizations were advised to un-enroll and re-enroll high-risk mobile devices after validating that no rogue provisioning profiles had been installed.

Broader Implications for Secure Mobility

The Ivanti EPMM intrusions underline the evolution of nation-state cyber operations toward mobile-first attack surfaces. Government networks have traditionally hardened their email servers, VPN concentrators, and perimeter firewalls, but the MDM platform—trusted by design to push security policies—became the blind spot. The ability to invisibly commandeer managed devices gave attackers a pervasive surveillance channel that bypassed conventional endpoint detection and response tools, which typically do not scan mobile devices at the same depth as workstations.

The supply chain element, wherein a service provider’s compromised EPMM instance cascaded into multiple ministries, mirrors the 2020 SolarWinds incident in miniature, yet with a uniquely mobile dimension. This highlights the urgent requirement for governments to enforce zero-trust principles not only for user access but also for device management servers themselves. Continuous validation of the MDM’s integrity, rigorous third-party risk assessments, and encrypted, tamper-proof logging of all administrative actions are no longer optional but critical components of national cyber defense posture. The Ivanti case serves as a stark reminder that the mobile edge is now the contested frontline of cyber espionage.