Clandestine IP Group Behind Widespread Attacks Exploiting Ivanti EPMM Vulnerabilities
Single IP Address Identified as Primary Source of Attacks on Ivanti Endpoint Manager Mobile Software
A single IP address, 193.24.123[.]42, has been identified as the primary source of attacks exploiting critical vulnerabilities in Ivanti Endpoint Manager Mobile software.
Exploitation of Vulnerabilities
According to a recent report, this IP address is responsible for 83% of attempted attacks leveraging CVE-2026-1281 and CVE-2026-1340 between February 1 and February 9.
Use of Automated Tooling
Researchers at GreyNoise observed that the IP address rotated through over 300 unique user agent strings, indicating the use of automated tooling.
Targeting of Government Agencies
The exploitation of Ivanti EPMM vulnerabilities has been particularly concerning, as several government agencies across Europe have been targeted.
Related News
In related news, a recent report by Censys found that over 190,000 web properties were vulnerable to a critical flaw in BeyondTrust’s Remote Support and Privileged Remote Access offerings.
Importance of Proactive Security Measures
The discovery of these vulnerabilities and the subsequent exploitation by malicious actors underscores the importance of proactive security measures, including vulnerability management and exposure management.
As the threat landscape continues to evolve, it is essential for organizations to stay vigilant and adapt their security strategies to mitigate emerging threats.
About Author
English