Active Ivanti Exploitation Traced to Single Bulletproof IP—Published IOC Lists Point Elsewhere
Summary: GreyNoise observed 417 exploitation sessions against two critical Ivanti Endpoint Manager Mobile vulnerabilities between February 1 and February 9, and 346 of them (83%) came from a single IP, 193[.]24[.]123[.]42, on a Censys-labeled bulletproof autonomous system that does not appear on widely circulated IOC lists. The most-shared IOCs instead pointed to M247 VPN exit nodes scanning Oracle WebLogic and a compromised ASUS router in Sweden with zero GreyNoise sessions, while 85% of the observed payloads only triggered DNS callbacks to confirm exploitability rather than deploying malware.
What you should know: If you blocked the published indicators but not AS200593, you addressed secondary infrastructure while the source accounting for 83% of observed Ivanti EPMM exploitation went unblocked. And because 85% of payloads only verified access, compromised EPMM instances may sit dormant for weeks or months - absence of visible post-exploitation activity is not evidence of safety.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-1281CVE-2026-1340
- Related
- Critical Vulnerabilities in Ivanti EPMM Exploited Cyber Risks ·CVE-2026-1340: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability Known Exploited Vulnerabilities · Apr 08, 2026CVE-2026-1281: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability Known Exploited Vulnerabilities · Jan 29, 2026