China-Nexus Threat Actor Actively Exploiting Ivanti Endpoint Manager Mobile (CVE-2025-4428) Vulnerability
A critical vulnerability in Ivanti Endpoint Manager Mobile (EPMM) is being actively exploited by a China-nexus threat actor, UNC5221. The exploitation targets internet-facing EPMM deployments across various sectors including healthcare, telecommunications, and government. The attackers utilize unauthenticated remote code execution to gain initial access, followed by the deployment of KrustyLoader malware for persistence. They leverage hardcoded MySQL credentials to exfiltrate sensitive data from the EPMM database. The threat actor also uses the Fast Reverse Proxy (FRP) tool for network reconnaissance and lateral movement. The compromised systems span multiple countries in Europe, North America, and Asia-Pacific, indicating a global espionage campaign likely aligned with Chinese state interests.
Pulse ID: 682e5bbc1075b03f94642762
Pulse Link: https://otx.alienvault.com/pulse/682e5bbc1075b03f94642762
Pulse Author: AlienVault
Created: 2025-05-21 23:03:24
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
Are you looking for an 
and 
Remote; Taipei, Taiwan
Full-time
Binance
SA-based | 
R40–60K CTC | Remote
