Ransomware

Threat Actors Exploiting Ivanti EPMM Vulnerabilities

Fonte ufficiale

Sintesi operativa EudorIA

Cosa significa

Priorità 95/100

CISA Cybersecurity Advisories ha pubblicato un advisory sul ransomware Threat Actors Exploiting Ivanti EPMM Vulnerabilities. La fonte descrive vulnerabilita o tecniche gia osservate in attacchi e richiede una verifica prioritaria.

Perché conta

L'advisory descrive attivita ransomware osservate e misure difensive pubblicate da un'autorita. Non prova che il proprio perimetro sia compromesso, ma richiede una verifica prioritaria di esposizione e controlli.

Azioni consigliate

Verificare e correggere con priorita i sistemi Internet-facing indicati dalla fonte; applicare MFA resistente al phishing, segmentazione e backup offline immutabili con prove di ripristino.
Verificare sistemi esposti, accessi remoti e versioni rispetto all'advisory ufficiale.
Confermare che backup offline e immutabili siano separati e ripristinabili.
Correlare TTP e IOC pubblicati con la telemetria autorizzata del proprio perimetro.

Benefici operativi potenziali

Prioritizzazione delle esposizioni Internet e delle vulnerabilita sfruttate
Verifica dei controlli su accessi remoti, movimento laterale ed esfiltrazione
Validazione documentata della capacita di ripristino

Indicazioni da confermare sul perimetro tecnico e organizzativo del cliente.

Controlli pertinentiVulnerability managementIdentity and access managementNetwork segmentationBackup and recoveryDetection and response

DestinatariITSOCCISOManagement

Centro informazioni

Traduzione in elaborazione

CISA

Il contenuto ufficiale è disponibile nella lingua originale. La versione italiana verrà pubblicata al termine dei controlli automatici.

Testo acquisito dalla fonte

Cybersecurity Advisory Threat Actors Exploiting Ivanti EPMM Vulnerabilities Release Date August 01, 2023 Alert Code AA23-213A Related topics: Securing Networks , Cyber Threats and Response SUMMARY The Cybersecurity and Infrastructure Security Agency (CISA) and the Norwegian National Cyber Security Centre (NCSC-NO) are releasing this joint Cybersecurity Advisory (CSA) in response to active exploitation of CVE-2023-35078 and CVE-2023-35081. Advanced persistent threat (APT) actors exploited CVE-2023-35078 as a zero day from at least April 2023 through July 2023 to gather information from several Norwegian organizations, as well as to gain access to and compromise a Norwegian government agency’s network. Ivanti released a patch for CVE-2023-35078 on July 23, 2023. Ivanti later determined actors could use CVE-2023-35078 in conjunction with another vulnerability CVE-2023-35081 and released a patch for the second vulnerability on July 28, 2023. NCSC-NO observed possible vulnerability chaining of CVE-2023-35081 and CVE-2023-35078. CVE-2023-35078 is a critical vulnerability affecting Ivanti Endpoint Manager Mobile (EPMM) (formerly known as MobileIron Core). The vulnerability allows threat actors to access personally identifiable information (PII) and gain the ability to make configuration changes on compromised systems. CVE-2023-35081 enables actors with EPMM administrator privileges to write arbitrary files with the operating system privileges of the EPMM web application server. Threat actors can chain these vulnerabilities to gain initial, privileged access to EPMM systems and execute uploaded files, such as webshells. Mobile device management (MDM) systems are attractive targets for threat actors because they provide elevated access to thousands of mobile devices, and APT act

Indicatori CISA verificabili

266 valori IOC dalla fonte ufficiale. Non sono una lista di blocco automatica: verificare data, contesto e applicabilita.

Copertura parziale: sono mostrati solo gli indicatori verificati e interpretabili. 1 allegati richiedono ancora verifica o un formato supportato.

Ultima verifica: 2026-09-26T07:02:08.386584+00:00

Scarica STIX 2.1

Tipo	Indicatore (non cliccabile)	File
mutex	`FEBBA89B4B9A9649B3A3BF41C4C7D853`
mutex	`FE9DE1CDD645971C5D15EE1873C3FF8D`
mutex	`FE6E7FAC4F0B4F25D215E28CA8A22957`
mutex	`FDFF2BF247A7DAD40BAC228853D5A661`
mutex	`FA4F1A3B215888BC5F19B9F91BA37519`
mutex	`F9D5CC0CBAE77EA1A371131F62662B6B`
mutex	`F967460F8C6DE1CEDB180C90C98BFE98`
mutex	`F8D6F89AECF792E844E72015C9F27C95`
mutex	`F8BCC8F99A3AFDE66D7F5AFB5D8F1B43`
mutex	`F804388F302AF1F999E4664543C885A1`
mutex	`F4DD9BB28D680A3368136FB3755E7EA9`
mutex	`F3D751B0585855077B46DFCE226CFEA1`
mutex	`F20FBFD508E24D50522EADF0186B03EB`
mutex	`F0776DFE17867709FDB0E0183ED71698`
mutex	`F05A5A60AD6F92D6F28FA4F13DED952F`
mutex	`EF4C4D79F02AC404F47513D3A73E20C7`
mutex	`EF35374F4146B3532F0902D6F7F0EF8C`
mutex	`ED82A50D98700179C8AE70429457477A`
mutex	`EB277D809A59D39D02605C0EDD9333E9`
mutex	`EA6BD3DB104CA210B5AD947D46134AAF`
mutex	`E99CFFA2AFA064625F09E1C5ACA8F961`
mutex	`E82B7AD2C05F4617EFBC86A78C1E61E9`
mutex	`E54329351788661F2A8D4677A759FC42`
mutex	`E3C642432A815A07F035E01308AAA8FC`
mutex	`E1F579227327EBB21CDE3F9E7511DB01`
mutex	`DDDFBAE77336120FEBD5AD690AF3E341`
mutex	`DC9E6EDEB7557BC80BE68BE15CEBB77A`
mutex	`DC26EF761C7EC40591B1FE6E561B521D`
mutex	`DBB293176747FA1C2E03CBC09433F236`
mutex	`DAEE31D7CC6E08EAD6AFAD2175989E1D`
mutex	`D966C6C822122E96F6E9F5F1D4778391`
mutex	`D92E87D2689957765987E2BE732D728E`
mutex	`D711D577B9943AB4E2F8A2E06BB963E3`
mutex	`D662D20507BEBC37B99A4D413AFA2752`
mutex	`D485A1B5DB2F97DC56500376D677AA89`
mutex	`D3D72F4C7038F7313AD0570E16C293BF`
mutex	`D3CFEE76468A9556FD9D017C1C8EE028`
mutex	`D2CEA317778AD6412C458A8A33B964FD`
mutex	`D255291BB8E460626CB906EBACC670E5`
mutex	`D173076D97A0400A56C81089912B9218`
mutex	`D131F17689F1F585E9BFDCDB72A626BB`
mutex	`D12D98A0877F6E3C8B5A59F41CC4DE9B`
mutex	`CEEF2E728DB1B5AE15432F844EEB66E1`
mutex	`CE0DD163D9E02BFD42D61024523CB134`
mutex	`CD1312BE032256A10CF866AF3E9AFAE9`
mutex	`CCDDDB69E9344A039C4AC9C49A6F2D7B`
mutex	`CCB15EEF4287C8EFA472915BCB4EC458`
mutex	`CBEEB123EFE8CF7F842426B673415C28`
mutex	`CBCD728A2350712B5747CD3447473DEB`
mutex	`C9C16287CBBE5A037244E374BA84AECC`
mutex	`C986C7BF720CE1463C3D628D2B3DAD01`
mutex	`C66F36EB180438882133717C3ABB5157`
mutex	`C262A39F49604F05A5656213F758CD46`
mutex	`C17B3EC40ED5216E44311138AAFAEA2C`
mutex	`C0A2FD066C955137036F92DA2C3A3FF1`
mutex	`C013F308D170AA2ECA4A5B0F0BBD3CCB`
mutex	`BE1F24457141D80206BC2E58F55DC879`
mutex	`BCF75736D176394F3DF69F3E0EF7DD9F`
mutex	`BCD62F3E029F96F62C24D50D2D1402AC`
mutex	`BA4A616C8D4AB9358A82B321D8E618BF`
mutex	`B9ECB08402DF0F1F6E1CE76B8AD6E91F`
mutex	`B956ED2B848DABB4E79AB7358233861B`
mutex	`B8F6B0D234A305C25411E83FD430C624`
mutex	`B8366AAA5ED51C0DEA3FC90EF7E14889`
mutex	`B79434613820FAF30D58F103C4415A29`
mutex	`B57F3E41C03803306B0EE2111F7EF823`
mutex	`B53F179B3F25F72BB0C7CCF45BF8BEEE`
mutex	`B50666C9AED1C2F222C56B6E9B326D27`
mutex	`B4F31423445B5F13675F205AC997F41F`
mutex	`B311AB82B30F41B12CB9089D00C4A1FF`
mutex	`AF06C3E72F2F307515BA549174D8E5A6`
mutex	`AEF0172A2C03F77912DE0BBF14AEE00F`
mutex	`AA2FE3A253E169B05E1782CA57A688D2`
mutex	`A98CF0A359F430A00F4F3D522F5B6CC0`
mutex	`A96837FE533247ABB7F88000D0216A50`
mutex	`A89DF6156EB5A2DE196388D4A123B470`
mutex	`A80B6A354B493264F37AA39D0D41B5FC`
mutex	`A596EBBCF438980C880D711315E4FDF1`
mutex	`A4F11B1EB659869A0AE70898A4A0E5EE`
mutex	`A260D836428CDB971BDF147CA6940160`
mutex	`A1B732A9AF792F75A68ED78D72FFB8F6`
mutex	`9FDD7A85B3A4EF8DED73BEB3E6218109`
mutex	`9F3BF94572344B36F6EF1689CB30C66E`
mutex	`9F2438AAAB4744C4B7B5B7287A783099`
mutex	`9EC17429EED5446E3720796AB50D8C60`
mutex	`9E5613533972A9D42D2E3344A4E58566`
mutex	`9DF128EBE0C82064AA746647883112C9`
mutex	`9D74D395BD2F72A47A5C980E6040DF5A`
mutex	`9CFDA02EF7E04C469B77F8197A249C17`
mutex	`9BA21C5148913186A5BF877078CBC048`
mutex	`9A176D818EDFF838FC057CEA3EE372C0`
mutex	`9980FEBFAF901D4113A1C473F79D7EB6`
mutex	`984C4653A563B19C87F264611A6ADC01`
mutex	`96C41E4C4A1812187FB279B9299AD63B`
mutex	`9622902CC43F4A20D0D686A37E4D8232`
mutex	`9610328CDAA4694800C2C93410F8CE82`
mutex	`95588E0386206FA02912CFCAF18C1220`
mutex	`934A8A6528E91CAA019ACB76E791A71D`
mutex	`9253399537FAD8448F1D4732DD79F6FA`
mutex	`922A3272AAD17C9EAAD733696A4321DA`
mutex	`918DFAB0333AE15D61F14FD24B5EAAAC`
mutex	`9188EF45EA917A91EC9B92B5DD8CD90D`
mutex	`905967B08BD44CFA60D969229921AC23`
mutex	`8FAFA73E9985E05D0C1C964DA770C567`
mutex	`8D5515351AFDF27B013F96A05BF45147`
mutex	`8BB1781E756A53CD00D9B2EC670FA21E`
mutex	`8B297F8B219E968932293EE7A8242CA3`
mutex	`8B0AE9029974091DF12210255AAECAD6`
mutex	`8AD0FD4B78C89BD63B97343FDA1EECCB`
mutex	`8A6B0BA3496EECA39D6D3F9BAE830C90`
mutex	`883B9FE16E45C388968DEFC73A5FBA7A`
mutex	`85C3FAC6A9885362C448F434671E362F`
mutex	`84301B967A4D9A242466C04901BAD691`
mutex	`840F488B7C0A5D686D1E89908735F354`
mutex	`833D3201066F5184C874C73A2083C448`
mutex	`830838CB0620D659405A74401CD72557`
mutex	`821F649D08687E22F96CEA99FBB5D3A3`
mutex	`8207129585DA68066ED08E94216D76EE`
mutex	`819030799F0020ED724C2EF3FFAA56C6`
mutex	`80BD0F3610F6C4D60584A5BE0B8A3016`
mutex	`802F5D34C230DA40C0912A1C5A9B702B`
mutex	`7E3630C67C802EABB67B108AD4D7DED7`
mutex	`7CD727171C2522F51417EDEEBA4F1791`
mutex	`7CBC7459DB5327C26476549F225030F5`
mutex	`7B9DB1D58326C1FA276BA2A39BCC2617`
mutex	`7B4137B4E85F31A81BB5BAFEDA993947`
mutex	`79C6D12D168B85437384B20EB94E106B`
mutex	`78988C65E9B70E7929E747408D8F0B0E`
mutex	`77A01363FA2B29AF25C004DA9570E23C`
mutex	`76C0D09FED2F33BABB0DE8EE2C07144C`
mutex	`75E874D8E0A79697633B87EA5E798B1C`
mutex	`74CF24F2A66A31C88B6FCFE01F12160C`
mutex	`74871691EAC48156CE0DA2CFA3AB401A`
mutex	`7292EF4CDCA529071FAD97496E1C9439`
mutex	`719EC5DA8F2153A436EE8567FF609894`
mutex	`708140C311D3D69418F75C928E7535A0`
mutex	`706B6055658AFF067AE370F23831EF6B`
mutex	`6FB8CDF567DD7D89D53B5771D769CB5F`
mutex	`6F1FA8B444CAF0D8238F948279CA74E1`
mutex	`6EAD0D5D3F87911C27F3AE0A75E6B5BC`
mutex	`6E3650528F719FC50988A1F697644832`
mutex	`6E359F3BBC622E9B1ED36F6E3D521BCF`
mutex	`69ECF52960C8BD9E746DFE9EE19C11F6`
mutex	`692F91C0C5E9E93E0A24BD3392887CA1`
mutex	`689385F1218E0D4C347595648CA6A776`
mutex	`67A42E2E27FFC26D1F3D0CEB8384AFD0`
mutex	`66F6A192083A7AB00AE8E0B5CC52E8F4`
mutex	`65EEF0A0EE257254EF0418AA57192CFB`
mutex	`646973D1928C401BA80961C12CBF84A2`
mutex	`6441640409815CFB4BF469E685E1BDB5`
mutex	`63FC58BE0D7B48EAA34DA7F752AE8AE6`
mutex	`635755DADFAB8B92FB502AAFB09122DB`
mutex	`634296A023280D020674C873D0199760`
mutex	`62AC194F2526EB45485526BCA35C8F43`
mutex	`61DEE38D2F97220EFB1218AD8971E3AB`
mutex	`6088C2A04C94CDCD5A283A6D1622FFBA`
mutex	`6010282004917ECF3900BABF61456432`
mutex	`5F4D5965AF741BBA59B7C8D3425F33DD`
mutex	`5E35F50C692081FD6C7DDAC1272E2D6C`
mutex	`5D55026FB84DBA91AC01E2095504B1BC`
mutex	`5D0259CA16CFC2D7D1B0FAC69F29AB05`
mutex	`59FAF75430E9326D3AE9D231BB3AE8C6`
mutex	`59EEC218522CC5C7743A0D37892A3345`
mutex	`59401C9A60449C742D073D93D1B7039A`
mutex	`58BC21D305A65C41745327F142F3AC12`
mutex	`588D0B42E54174A98E1ECA59945E8B32`
mutex	`555389E92C622B87D3FC395FD8723501`
mutex	`549CDE6535A884126755FC53F59A820C`
mutex	`5466368D4659F1B1470BCB09E65B484D`
mutex	`539F1A5183800A96228458932F9307F7`
mutex	`5244B163F9326A1E5EAA8860F7543F99`
mutex	`4D34DB639BA84B11822FB3DAC47ED7D1`
mutex	`4C1B73EC52E6EEC0C5D20577FCBC9EF1`
mutex	`49D2BD08038DC7DADA221008591940F9`
mutex	`495C6FF7CA0379AD0891BAC47917D09A`
mutex	`4959A611B9885022D81B4BC8E4B1D149`
mutex	`49230C486F0FD383CD301FE162D6A786`
mutex	`4898A51256AE7D914A5FFD5695973470`
mutex	`476E72BBDA5B78D188766139889E3038`
mutex	`43C22DABB1E6D2449A39C2F7E974D537`
mutex	`41854ADBC73B0B58E5C566F60BB0DF25`
mutex	`404F56045E436D53EAD2177BF957BA39`
mutex	`403273B51F91CF3C333695E5532CB2C3`
mutex	`3DD13FAAD1C45EB0C23E4567210F7EAC`
mutex	`3BE529EB3A7DAAF34F963A22188F6139`
mutex	`3BD1BDB5E90B9590A8878BFF2ADA8204`
mutex	`3B30B4555CC8B4B164AD03CF322CBEA8`
mutex	`3B22AF324ABDED2781ED8F6A61F3654F`
mutex	`3962B622C5AA815AFB803B92AA948424`
mutex	`393662E5AA0CB49C5D666A6D10A1ADE6`
mutex	`391A4C2C7541B8B78E2F99BF586E9794`
mutex	`37D952966EA7E79277803F13D7147544`
mutex	`3744004013135B9F9A05CB58CDA8134D`
mutex	`3685ABC75517E61E47E52E5F2D060F54`
mutex	`361F47A6357CC6E3A9BCDD20CFAAF0E9`
mutex	`34D92552E278710C1E84F0BD8DC3A6B8`
mutex	`34AC9A6EF5D285119ABEC50FBE41FCFE`
mutex	`32775EAD3EA1AD7DB2F4BEA67FE0CABB`
mutex	`3268A5097A543C7DBD82C39A9193B7FE`
mutex	`30BE84E6B95F44C203F8E7FCE7339A8E`
mutex	`30A9F568EB3DF79352FC587A078623B6`
mutex	`309D33C6F77A3FC75654C44C61596CCD`
mutex	`3082E669DDA9D023E2DCD8B9549A84A8`
mutex	`3003024AFE64B4E8A5A30825C14BBB12`
mutex	`2EBC7FDCEAA9A0DF556E989D77157006`
mutex	`2BEECB6B9E386F29D568229A9953C3D2`
mutex	`2AA8BA7478B1362274666D714DF575BC`
mutex	`289A450C7478DD52A10C6ED2FB47F7E9`
mutex	`276E175D4FE8454C4C47E966D8CB3FA3`
mutex	`253FD4659BF21BE116858BC0F206C5B9`
mutex	`23E3E6FA8B23D9BC19E82DE4E64C79E9`
mutex	`22CC1B3BC9F99D3A520AE58FEE79A0D5`
mutex	`206FED3A39D9215C35395663F5BB3307`
mutex	`1EC71612E438CF902913EEC993475EB9`
mutex	`1E0850E10A00C9BBDD5C582FF4CB6833`
mutex	`1B7D9368C6CE7623FDBC43F013626535`
mutex	`1B6720ED0B67C910A80722CE973D6217`
mutex	`1ABFDEAADB74A0F7C461E7BAB157B17F`
mutex	`1AA7DAE8F2AE0A29402ED51819F82DB4`
mutex	`1A024E63721C610D2E54E67D62CD5460`
mutex	`19F51486ABD40C9F0FC0503559A6C523`
mutex	`188623FDD056C4ED13D1FF34C7377637`
mutex	`16A74FC216F8A4CE43466BB83B6D3FD2`
mutex	`1660F3D882A4311CA013EE4586E01FD9`
mutex	`15A074A397727B26A846B443B99C20FF`
mutex	`151BC875DF15D1385E6EB02F9EDABA06`
mutex	`14994353F3EA6FD25952A8C7D57F9ECF`
mutex	`146CAF9BD0153428F54E9EF472154983`
mutex	`14671C3F8DECA7D73A03B74CB854C21D`
mutex	`1336DF27F94B25A25ACAC9DB3E61E461`
mutex	`11C506D5E3FB7E119C4287202C96A930`
mutex	`119F8C9050D1499B6F958B857868B8CE`
mutex	`0F6E78839398C245D13F696A3216D840`
mutex	`0E1FAD8FFAA7A939F0A6CBF9CD7E2FCD`
mutex	`0DA24834056873A8CD8311000088E8BE`
mutex	`0CB0380CF75A863B3E40A0955B1ADA9F`
mutex	`0B8E1211DE50D244B89E6C1B366D3CCF`
mutex	`0B28842D64A344C287E6165647F3B3FE`
mutex	`09DF72C01A1A0AD193E2FFF8E454C9C4`
mutex	`07A624D7236CCA3934CF1F8E44B74B52`
mutex	`070F9FE9F0EC69E6B8791D280FDE6A48`
mutex	`04E7F5787F89A597001B50A37B9F8078`
mutex	`045F8CCDAC6D4E769B30DA406808DA71`
mutex	`03F8852448A85E14F2B4362194160C32`
mutex	`02BE3B93640437DBBA47CC7ED5AB7895`
mutex	`0212A88C7ED149FEBDEFA347C610B248`
mutex	`01ECD9AB9BE75E832C83C082BE3BDF18`
mutex	`00E872019B976E69A874EE7433038754`
mutex	`0092CE298A1D451FBE93DC4237053A96`
mutex	`EB5FDC72F0A76657DC6EA233190C4E1C`
mutex	`E84A32D43DB750B206CB6BEED08281D0`
mutex	`E669667EFB41C36F714C309243F41CA7`
MD5	`e60dc8370ecf78cf115162fbc257baf5`
MD5	`ad55557b7cbd735c2627f7ebb3b3d493`
mutex	`8D9F7747675E24454CD9B7ED35C58707`
mutex	`849D3331F3E07A0797A02F12A6A82AA9`
mutex	`473CD7CB9FAA642487833865D516E578`
mutex	`2D5BD942EBF308DF61E1572861D146F6`
MD5	`1c8e55823e415fabeffca526aa285072`
SHA-1	`1cd358d28b626b7a23b9fd4944e29077c265db46`
SHA-256	`6255c75e2e52d779da39367e7a7d4b8d1b3c9c61321361952dcc05819251a127`
SSDEEP	`96:hv3jaMVQoJ08mSr4ANreokFiFek3RDIkeK97NOHMVgFtjk6txfJ:hXVQwfr4AhzukhDIkJxO0gF+cxh`
SHA-1	`c0b42bbd06d6e25dfe8faebd735944714b421388`
mutex	`579CCEF312D18482FC42E2B822CA2430`
MD5	`e1d8b04eeb8ef3954ec4f49267a783ef`
MD5	`cd08e31494f9531f560d64c695473da9`

Provenienza

Allegato ufficiale CISA · 2023-08-02T14:27:43Z

SHA-512: ebfa55e0d1f673c9d2353eb5951877dc203b9846c4d989c5f174eb1e81f11475c85afe33ba502ecc0698a5402fd9b62bb21a77d6c96391bc1bc339950ca50401

Fonte: CISA Cybersecurity Advisories
Entità pubblicatrice: CISA
Tipo entità: Autorità nazionale
Area: North America · US
Lingua originale: en · traduzione in preparazione
Pubblicazione: 01/08/2023 14:00
Condivisione: TLP:CLEAR
MITRE ATT&CK: T1001, T1001.003, T1005, T1018, T1021.001, T1027, T1036.005, T1057, T1059, T1059.001, T1068, T1070, T1070.001, T1087, T1087.002, T1090, T1090.001, T1190, T1213, T1505, T1505.003, T1572, T1584, T1584.005, T1595, T1595.002
CVE: CVE-2023-35078, CVE-2023-35081, CVE-2023-30578
Classificazione: Critica
Paese indicato: US

Perimetro tecnico

Prodotti e versioni interessati

Verifica in corso

Informazione non ancora acquisita.

Il collector verificherà NVD e gli advisory vendor ufficiali disponibili.

Azione indicata dalla fonte

Verificare e correggere con priorita i sistemi Internet-facing indicati dalla fonte; applicare MFA resistente al phishing, segmentazione e backup offline immutabili con prove di ripristino.

Riferimenti tecnici ufficiali

Apri la fonte originale