Latest / Tech Talks With Kinsoft / Ivanti Zero-Days Breach the EU Commission & Dutch Govt

Transcript

Ivanti Zero-Days Breach the EU Commission & Dutch Govt · Tech Talks With Kinsoft

0:00
welcome to tech talks with kinsoft glad to be
0:02
here so today we're looking at something that
0:04
honestly it feels a bit like a movie script it
0:08
really does yeah because the very software designed
0:12
to be you know this ultimate digital bodyguard
0:15
for places like the European Commission and the
0:17
Dutch government. It just became the exact weapon
0:21
used to break into them. Yeah, it's a massive
0:23
twist. Right. And our mission for this show is
0:25
simple. We take a stack of your sources like
0:28
articles, technical research, advisory notes,
0:31
and we extract the most important nuggets of
0:33
knowledge out of them. Exactly. We do the heavy
0:35
lifting of reading and synthesizing. So you,
0:38
the listener, get a shortcut to staying well
0:40
informed without that dreaded information overload.
0:43
And today's sources are painting a very, very
0:45
tense picture. Yeah, tense is an understatement.
0:48
We're looking at emergency warnings from national
0:50
security agencies across the U .S., Canada, Singapore,
0:54
and the U .K. Wow, so globally. Yeah, globally.
0:57
They are all sounding the alarm over a highly
1:00
coordinated wave of cyber attacks. And they're
1:03
targeting a specific piece of software used by
1:06
major organizations to manage and secure their
1:09
mobile devices. Right off the bat, that feels
1:11
incredibly counterintuitive. Oh, absolutely.
1:13
Like if these systems are specifically built
1:15
to enforce security on our phones, isn't it incredibly
1:17
ironic that they are the very things letting
1:20
the attackers in? It is, but... It really comes
1:23
down to the immense power these platforms hold.
1:26
Right. The specific software in the crosshairs
1:28
today is called Ivanti Endpoint Manager Mobile,
1:32
or EPMM. Okay. EPM. Yeah. And to understand the
1:36
vulnerability, we first need to understand the
1:38
mechanism of what an MDM, a mobile device management
1:41
platform, actually does. Okay. Break that down
1:44
for us. Basically, organizations use EPMM to
1:46
control their entire fleet of smartphones and
1:48
tablets. So if I'm, say, working for a government
1:51
agency and I'm using a company -issued phone,
1:53
EPMM is like the invisible hand controlling what
1:56
I can and cannot do. That's a really good way
1:58
to look at it, yeah. Yeah. It dictates your app
2:00
settings, monitors compliance, and... It can
2:04
even remotely wipe the device if you lose it
2:06
on a train. Oh, wow. Okay. It acts as the central
2:09
brain enforcing security rules across the whole
2:12
mobile network. Right. But because it has absolute
2:16
authority over thousands of remote devices, it
2:19
requires a constant open line of communication
2:22
to the outside world. Which means it has to be
2:24
exposed. Exactly. I mean, it can't hide behind
2:26
a massive internal firewall if it needs to, you
2:29
know, talk to an employee's phone while they're
2:31
sitting in a coffee shop in another country.
2:33
Precisely. That is exactly why they are such
2:35
high value targets. Makes sense. And this brings
2:38
us to the core issue. There are two specific
2:40
vulnerabilities discovered in late January. Tract
2:43
is CVE -2026 -1281 and CVE -2026 -1340. OK, those
2:50
are the exact designations. Right. And, you know,
2:52
cybersecurity scales rank threats from 1 to 10
2:55
based on their severity. Yeah. These two flaws
2:58
sit at a 9 .8. A 9 .8 out of 10. I know a 9 .8
3:01
sounds terrifying on paper, but... What does
3:04
that actually mean in practice? Like, why isn't
3:07
it a 5 or a 6? Well, a 9 .8 essentially means
3:11
the vulnerability allows for unauthenticated
3:14
remote code execution. Okay, let's break those
3:16
terms down for a second. Unauthenticated means?
3:19
It means the attacker doesn't need to steal a
3:21
username. Oh, wow. Yeah, they don't need to guess
3:24
a password, and they don't need to intercept
3:26
a two -factor authentication code. Nothing at
3:28
all? Nothing. They need absolutely zero credentials
3:31
to interact with the system. I admit, I hear
3:33
terms like code injection and remote code execution
3:36
thrown around a lot. But how does someone actually
3:39
force a secure server to run their malicious
3:41
commands without even logging in first? So the
3:44
mechanism is actually a flaw in how the software
3:47
processes input. Okay. Normally, a system expects
3:50
specific data in specific fields, like entering
3:53
your name into a form. Right. But with a code
3:55
injection vulnerability, the software fails to
3:58
sanitize or separate the data from the underlying
4:01
system commands. So, an attacker sends a carefully
4:05
crafted message to the server. And instead of
4:09
reading it as data, the server's back end gets
4:11
confused. It thinks it's an instruction. Exactly.
4:14
It reads it as an administrative command. It
4:16
just blindly executes whatever the attacker typed.
4:19
Okay, let me see if I can picture this physically.
4:20
Go for it. So an edge device like EPMM is essentially
4:24
the bouncer at the club's front door, right?
4:26
Yeah. But with a 9 .8 vulnerability, the bouncer
4:29
isn't just letting people in with that ID. The
4:32
bouncer is actively handing out master keys to
4:35
the whole building. That's a great analogy. It's
4:37
actually a bit like a secure corporate building
4:39
that has an automated pneumatic tube system on
4:42
the outside wall for employees to drop off work
4:45
orders. Oh, right. Because it's Internet facing.
4:47
Exactly. That pneumatic tube has to be accessible
4:50
from the street. So anyone walking by can drop
4:53
something in. Right. And the flaw is that the
4:56
automated sorting room inside the building doesn't
4:58
check who sent the capsule. Yes, exactly. An
5:01
attacker just drops in a forged work order that
5:04
says, you know, fire the security guards and
5:06
send. the vault combination to this external
5:08
address. And the internal system just processes
5:11
it automatically? It processes it with the highest
5:14
level of authority. That is the reality of unauthenticated
5:17
remote code execution. That is just wild. It
5:21
is. And, you know, the UK NHS Digital's National
5:25
Cybersecurity Operations Centre, the CSOC, they
5:29
emphasize this in their advisory. What did they
5:31
say? They pointed out that edge devices like
5:33
EPMM are internet -facing by design. Attackers
5:36
know this. Right. They know it's sitting right
5:38
there on the perimeter. Yeah, which is why vulnerabilities
5:40
here are rapidly weaponized at zero days. The
5:43
target is just sitting out there in the open.
5:45
Right. So since we know the front door was left
5:47
wide open, who exactly sneaked inside before
5:50
the vendor could get a patch out in late January?
5:53
Well, the confirmed victims include some very
5:55
high -profile government entities. Like who?
5:58
We have verified breaches within the Dutch government,
6:01
specifically, and somewhat ironically, the Dutch
6:04
Data Protection Authority. Wait, the Data Protection
6:07
Authority itself? Yes, the AP and also the Judicial
6:10
Council. You really can't write that kind of
6:11
irony. The data protectors got their data stolen.
6:14
Pretty much. But I want to dig into what was
6:17
actually stolen here. According to the country's
6:20
State Secretary for Justice and Security, attackers
6:23
viewed work -related data of the employees. Right.
6:27
We are talking about names, business email addresses,
6:30
and phone numbers. Yeah, that's the extent of
6:33
the compromised data that was publicly confirmed.
6:36
You know, for you listening right now, it might
6:38
be incredibly easy to shrug that off. Oh, for
6:40
sure. You hear government data breach, and you
6:42
immediately expect, like, stolen state secrets
6:45
or classified documents. Names and phone numbers
6:49
sound like they just walked off with a corporate
6:50
phone book. Yeah, it doesn't sound that scary.
6:53
Right. Why is a stolen phone book treated as
6:55
a national security incident? So taking a step
6:58
back to look at modern attack chains changes
7:01
the perspective completely here. Okay. A corporate
7:03
phone book belonging to a government's data protection
7:06
authority is an absolute goldmine. A goldmine
7:09
for what? It provides the exact blueprint a threat
7:13
actor needs. For highly targeted spear phishing
7:16
campaigns. Oh, I see. So it's not the end goal.
7:19
It's the reconnaissance phase. Exactly. It's
7:21
the crucial first step. Right. Imagine an attacker
7:23
wants to compromise a senior judge. Right. If
7:26
they send a generic malicious email, it gets
7:29
flagged by spam filters or just ignored. Sure.
7:31
But now, because they have the EPMM data, they
7:34
know exactly who works in which department, what
7:37
their email is and what their mobile number is.
7:39
So they can make it. Super convincing. Incredibly
7:42
convincing. They can text an employee saying,
7:44
you know, this is Dave from IT. Your EPMM mobile
7:47
profile is failing to sync. Click this link to
7:50
re -authenticate. Wow. And because the employee
7:53
knows they actually use EPMM and the text is
7:56
coming to their specific work device, they are
7:58
infinitely more likely to click it. It weaponizes
8:01
their own organizational context against them.
8:04
Exactly. The psychological manipulation becomes
8:06
much more effective. And that's why the theft
8:08
of basic directory information is treated with
8:11
emergency severity. That makes a lot of sense.
8:13
The Dutch government wasn't the only major European
8:17
entity caught in this wave, though. No, they
8:19
weren't. The European Commission was also targeted.
8:21
Yes. On January 30, 2026, CERT -EU. that's the
8:26
cybersecurity team for all EU institutions, they
8:29
detected an intrusion on the European Commission's
8:32
central infrastructure. Specifically, the infrastructure
8:35
managing their mobile devices. Right. Now, they
8:38
didn't explicitly name Ivanti EPMM in their initial
8:42
public statement. Oh, they didn't? No. But reading
8:45
through the industry consensus, it's widely understood
8:47
that they were dealing with the exact same platform.
8:49
The timing and the nature of the compromise were
8:52
identical. Right. The mechanics of the attack
8:54
were the same. And the commission acknowledged
8:56
that the intrusion may have resulted in access
8:58
to staff names and mobile numbers, just like
9:01
the Dutch breach. Exactly. But I want to pause
9:03
here because the timeline of the European Commission
9:06
story is completely wild compared to a typical
9:10
government data breach. It really is. The timeline
9:13
is arguably the most crucial takeaway from this
9:15
entire campaign. CERT -EU detected the intrusion,
9:19
and the Commission's security teams moved with
9:22
staggering speed. They ensured the incident was
9:25
contained, the vulnerability was isolated, and
9:27
the entire system was completely cleaned within
9:30
exactly nine hours. Nine hours. Nine hours. I
9:34
want to highlight this for you, the listener,
9:35
because context is everything here. When we usually
9:39
read reports about major network intrusions,
9:41
the dwell time, which is the amount of time an
9:44
attacker sits inside a network before being discovered,
9:47
is typically measured in weeks, right? Weeks,
9:49
if not months. The global median dwell time often
9:53
hovers around two to three weeks. And for sophisticated
9:56
state -sponsored actors, they can remain undetected
9:59
for hundreds of days. Wow. So detecting, containing
10:02
and cleaning an intrusion on a massive governmental
10:05
infrastructure in nine hours is exceptional.
10:08
And because of that incredible speed, no actual
10:11
mobile devices were compromised. Right. The attackers
10:13
broke into the central management server. They
10:15
might have scraped that contact list we talked
10:17
about, but they were kicked out before they could
10:19
pivot and push any malicious commands down to
10:22
the actual smartphones. The containment prevented
10:24
the worst case scenario. If the attackers had
10:27
more time, they could have used the server's
10:29
authority to silently install spyware on every
10:32
single government -issued phone. Which is terrifying.
10:35
Truly. And it really shifts how we have to think
10:37
about cybersecurity. You know, in a world where
10:39
zero days are inevitable, where your time to
10:43
containment is the difference between a leaked
10:44
phone book and a total network takeover. Absolutely.
10:48
Fast detection and rapid containment are what
10:51
saved the EC from an unrecoverable compromise.
10:54
But let's look at the practical reality for everyone
10:56
else. Nine hours is incredibly fast for the European
10:59
Commission. But what about the organizations
11:01
that didn't catch it on day one? Yeah, that's
11:04
the big question. Can they just install the late
11:06
January patch from Avanti, run the newly released
11:09
detection script, and sleep soundly? The short
11:12
answer is a resounding no. Really? Just patching
11:16
isn't enough? No. The Dutch National Cybersecurity
11:18
Center, the NCSC -NL, issued very stark advice
11:22
regarding this. They explicitly warned organizations
11:25
that even if you patched quickly, you must assume
11:28
compromise. Assume compromise. Let's unpack that.
11:32
Does that mean even if I patched my system the
11:35
minute the update came out, I have to operate
11:38
under the assumption that someone already broke
11:40
in? Yes. You have to operate under that assumption
11:42
because threat actors may have already exploited
11:45
the system and wiped their tracks. They wiped
11:47
their tracks. Oh, absolutely. They delete the
11:49
access logs. They remove the initial malware
11:51
they used to break in. They know you were going
11:54
to run a detection script eventually. Right.
11:56
So if an IT admin runs a detection tool and it
11:59
comes back clean, that doesn't actually mean
12:02
the system was never hacked. It just means the
12:04
threat actor might be exceptionally good at digital
12:07
housekeeping. The absence of evidence is not
12:10
evidence of absence. That is a chilling thought.
12:13
So if patching just fixes the broken lock but
12:16
the attacker is already inside the house, what
12:18
are the actionable steps? The NCSCNL laid out
12:21
strict advice, right? They did. First, you are
12:24
required to change all passwords for every single
12:27
account present on that system. Okay, change
12:29
all passwords. Because if the attackers were
12:30
inside, you have to assume they scraped the entire
12:33
credential database. That makes sense. The second
12:36
step is even more critical and often overlooked.
12:39
You must renew the private keys in use on the
12:42
system. Wait, private keys? How do they factor
12:44
into this? Private keys are cryptographic files
12:48
used to authenticate secure communications. Right.
12:51
Like between the server and the mobile devices.
12:53
Okay. If an attacker steals those private keys,
12:56
they can essentially forge legitimate connection.
12:59
They can impersonate the server itself. So even
13:01
if I change the human passwords and patch the
13:04
flaw, if I don't renew those cryptographic keys,
13:07
the attacker just walks right back in disguised
13:09
as the server. Exactly. You have to burn the
13:11
old cryptographic locks and install completely
13:13
new ones. Wow. And finally, they heavily advise
13:17
monitoring internal traffic originating from
13:20
that ePMM system, looking for signs of lateral
13:22
movement. Right, lateral movement. That's when
13:25
the attacker uses the compromised server as a
13:27
lily pad to... jump deeper into the network.
13:30
Exactly. And to prove this isn't just a one -off
13:32
anomaly, this product family is a continuous
13:35
high -value target. Yeah, I want to remind the
13:37
listener about the historical context here. We
13:40
saw very similar flaws in EPMM hacked 12 Norwegian
13:43
agencies back in 2023. Yep. And it didn't stop
13:46
there. In May 2025, CERT -EU reported two other
13:50
Ivanti EPMM zero days exploited in the wild.
13:54
Right. Which were later tied to a suspected China
13:56
nexus threat actor targeting multiple global
13:59
sectors. Healthcare, finance, defense. It was
14:01
a huge deal. A massive deal. So synthesizing
14:04
all these takeaways for you, the listener. We
14:06
really see the danger of internet -facing edge
14:09
devices. Absolutely. And when dealing with CVSS
14:11
9 .80 days, patching is merely the baseline.
14:14
The true defense lies in rapid detection like
14:17
the EC's nine -hour containment and adopting
14:19
an assume -compromise posture. That is the new
14:22
reality. Now, if you're looking to fortify your
14:24
own network and want to discuss your security
14:26
and IT needs, make sure to visit www .kinsoft
14:29
.com .au. And as we wrap up, I want to leave
14:32
you with a final lingering question to ponder.
14:35
Okay, let's hear it. As organizations push more
14:37
and more security enforcement to the edge of
14:39
their networks to protect remote workers and
14:41
mobile devices, are we actually just moving our
14:44
most valuable, vulnerable targets outside the
14:47
safety of the castle walls? Wow. That is definitely
14:50
something to think about. Thank you for listening,
14:52
and we'll catch you on the next episode.