Week of March 31, 2025

CVE-2025-22458 is a DLL hijacking vulnerability in Ivanti Endpoint Manager that allows an authenticated attacker to escalate privileges to SYSTEM. The flaw arises from improper DLL search path handling, enabling malicious DLL placement in writable directories. Affected versions include Ivanti Endpoint Manager 2024 prior to SU1 and 2022 prior to SU7.

Researchers from W2H Corp. published a proof-of-concept technique that bypasses EDR by hijacking the AvrfpAPILookupCallbackRoutine callback in ntdll.dll during early process initialization, before the EDR DLL loads. The method uses C# and .NET 8 to inject shellcode and hook functions like LdrLoadDll, neutralizing all major EDR solutions. This pre-monitoring phase exploitation allows attackers to run code undetected.

Check Point confirmed a December 2024 incident where compromised credentials for a portal account led to limited data exposure. The threat actor CoreInjection later claimed to sell stolen data, but Check Point states the exposed information was limited to account names, product names, employee emails, and three customer contacts, with no access to production systems or security architecture.