<description>&lt;p&gt;In this episode of Cyber Insiders, Cian Heasley, Threat Lead at Adarma, walks us through our Incident Response team&amp;#39;s investigation into the exploitation of Ivanti Endpoint Manager Mobile (EPMM) by UNC5221, a threat group linked to the Chinese state. &lt;/p&gt;&lt;p&gt;Cian breaks down how the attackers chained CVE-2025-4427 and CVE-2025-4428 to gain unauthenticated remote code execution, what tools and techniques they used, and explains why this campaign shows signs of strategic pre-positioning. &lt;/p&gt;
</description>

<p>In this episode of Cyber Insiders, Cian Heasley, Threat Lead at Adarma, walks us through our Incident Response team&#39;s investigation into the exploitation of Ivanti Endpoint Manager Mobile (EPMM) by UNC5221, a threat group linked to the Chinese state. </p><p>Cian breaks down how the attackers chained CVE-2025-4427 and CVE-2025-4428 to gain unauthenticated remote code execution, what tools and techniques they used, and explains why this campaign shows signs of strategic pre-positioning. </p>


CYBER INSIDERS

UNC5221 Exploits Ivanti EPMM: What Adarma’s Incident Responders Have Uncovered

UNC5221 Exploits Ivanti EPMM: What Adarma’s Incident Responders Have Uncovered

Description