Ivanti EPMM zero-days used to breach 12 Norwegian ministries

Updates on Jul 23, 2023

Summary

APT actors exploited an unauthenticated API access bug in Ivanti Endpoint Manager Mobile (formerly MobileIron Core) as a zero-day from at least April 2023. They used it to break into the shared IT platform of 12 Norwegian government ministries, possibly chaining it with a file-write bug (CVE-2023-35081).

Advisories4

• Threat Actors Exploiting Ivanti EPMM Vulnerabilities (AA23-213A)CISA / NCSC-NO · Aug 1, 2023
• NVD: CVE-2023-35078NVD
• NVD: CVE-2023-35081NVD
• CISA Known Exploited Vulnerabilities CatalogCISA · Jul 25, 2023