83% of Ivanti EPMM Exploits Linked to Single IP on Bulletproof Hosting Infrastructure

"A significant chunk of the exploitation attempts targeting a newly disclosed security flaw in Ivanti Endpoint Manager Mobile (EPMM) can be traced back to a single IP address on bulletproof hosting infrastructure offered by PROSPERO. Threat intelligence firm GreyNoise said it recorded 417 exploitation sessions from 8 unique source IP addresses between February 1 and 9, 2026. An estimated 346 exploitation sessions have originated from 193.24.123[.]42, accounting for 83% of all attempts."

"The malicious activity is designed to exploit CVE-2026-1281 (CVSS scores: 9.8), one of the two critical security vulnerabilities in EPMM, along with CVE-2026-1340 that could be exploited by an attacker to achieve unauthenticated remote code execution. Late last month, Ivanti acknowledged it's aware of a "very limited number of customers" who were impacted following the zero-day exploitation of the issues. Since then, multiple European agencies, including the Netherlands' Dutch Data Protection Authority (AP), Council for the Judiciary, the European Commission, and Finland's Valtori, have disclosed that they were targeted by unknown threat actors using the vulnerabilities."

""The IP rotates through 300+ unique user agent strings spanning Chrome, Firefox, Safari, and multiple operating system variants," GreyNoise said. "This fingerprint diversity, combined with concurrent exploitation of four unrelated software products, is consistent with automated tooling." It's worth noting that PROSPERO is assessed to be linked to another autonomous system called Proton66, which has a history of distributing desktop and Android malware like GootLoader, Matanbuchus, SpyNote, Coper (aka Octo), and SocGholish."

417 exploitation sessions targeting Ivanti Endpoint Manager Mobile (EPMM) were recorded between February 1 and 9, 2026, originating from eight unique source IPs. One IP, 193.24.123[.]42, accounted for approximately 346 sessions, or 83% of the activity. The exploits targeted CVE-2026-1281 (CVSS 9.8) and CVE-2026-1340, both capable of unauthenticated remote code execution. A very limited number of customers experienced impact from zero-day exploitation, and several European agencies reported being targeted. The attacking host concurrently probed other product CVEs, rotated 300+ user-agent strings, and leveraged PROSPERO-linked hosting tied to Proton66 malware distribution.

Read at The Hacker News