Ivanti EPMM flaw exploited by Chinese hackers to breach govt agencies

Chinese-linked UNC5221 has been observed exploiting an Ivanti Endpoint Manager Mobile zero-day (CVE-2025-4428) — alongside an authentication bypass (CVE-2025-4427) — to gain initial access to numerous government, healthcare, industrial, and corporate organizations globally; attackers conducted reconnaissance, deployed KrustyLoader and linked to the Auto-Color backdoor, exfiltrated data, and abused internal Office365 tokens and LDAP, with exploitation observed within days of the vendor patch and clear evidence of espionage-focused activity.