83% of Ivanti EPMM Exploits Linked to Single IP on Bulletproof Hosting Infrastructure
Summary: GreyNoise recorded 417 exploitation sessions against Ivanti Endpoint Manager Mobile from 8 unique source IP addresses between February 1 and 9, 2026, with an estimated 346 sessions (83%) originating from 193.24.123[.]42 on bulletproof hosting infrastructure offered by PROSPERO. The activity targets CVE-2026-1281 (CVSS 9.8) and CVE-2026-1340, unauthenticated remote code execution flaws that Ivanti said affected a "very limited number of customers," and the same host was concurrently exploiting three other CVEs across unrelated software using 300+ rotating user agent strings.
What's compelling: European agencies including the Dutch Data Protection Authority, the Council for the Judiciary, the European Commission, and Finland's Valtori have disclosed they were targeted, and 85% of sessions beaconed home via DNS to confirm exploitability without deploying malware - cataloging vulnerable targets for later access sales rather than immediate payloads.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-1281CVE-2026-1340
- Related