Ivanti EPMM zero-days used to breach 12 Norwegian ministries
Ivanti Endpoint Manager Mobile (EPMM / MobileIron Core)
APT actors exploited an unauthenticated API access bug in Ivanti Endpoint Manager Mobile (formerly MobileIron Core) as a zero-day from at least April 2023. They used it to break into the shared IT platform of 12 Norwegian government ministries, possibly chaining it with a file-write bug (CVE-2023-35081).
Why this severity: CVSS 9.8 (NVD), zero-day, actively exploited (CISA KEV), known ransomware use
- Started
- Jul 24, 2023
- Closed
- Aug 15, 2023
Affected
- CVE-2023-35078: see vendor advisory
- CVE-2023-35081: 11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2, 11.8.x < 11.8.1.2 (NVD)
Fixed in
- CVE-2023-35081: 11.10.0.3, 11.9.1.2, 11.8.1.2 (NVD)
- CVE-2023-35078: see vendor advisory
Updates by day6
▸Aug 15, 2023
Link #Norway shuts down the old ministry e-mail solution and rolls out a new one
Source
▸Aug 1, 2023
Link #CISA and NCSC-NO advisory AA23-213A: exploited as a zero-day since at least April 2023
Source
▸Jul 28, 2023
Link #Ivanti patches the second bug, CVE-2023-35081
▸Jul 25, 2023
Link #CISA adds CVE-2023-35078 to the KEV catalog
▸Jul 24, 2023
Link #Norway: cyber-attack on the ICT platform used by 12 ministries through a zero-day in a supplier's software
Source
▸Jul 23, 2023
Link #Ivanti patches CVE-2023-35078
Source
Advisories4
News & write-ups3
Get an email when a new major security incident drops. No spam, unsubscribe any time.
