9X Surge in Ivanti Connect Secure Scanning Activity
Summary: On April 18, 2025, GreyNoise observed a 9X spike in suspicious scanning activity targeting Ivanti Connect Secure and Pulse Secure VPN systems, with 234 unique IPs probing endpoints against a usual daily baseline of fewer than 30. GreyNoise reports 1,004 unique IPs over the past 90 days, all non-spoofable, and notes that no specific CVEs have yet been tied to this scanning, though weeks later two zero-days were disclosed in the related Ivanti EPMM product.
What's compelling: GreyNoise frames scanning as a leading indicator that can precede public zero-day disclosure, and the 234 IPs on April 18 came before the EPMM zero-days surfaced - so the reconnaissance already logged against your Ivanti remote-access estate may be the earliest warning you get.
Read the original at GreyNoise Blog ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026