TL;DR

Majority of attacks exploiting Ivanti EPMM vulnerability tied to a specific IP within bulletproof hosting infrastructure.

What happened

['Exploitation attempts targeting Ivanti EPMM flaw traced back to single IP', 'GreyNoise recorded over 417 exploitation sessions from this IP between Feb 1-9, 2026']

Why it matters for ops

['Vulnerability in EPMM exposes organizations to targeted attacks', 'Bulletproof hosting allows malicious actors to evade detection and enforcement']

Mitigation

  • Apply security patches for EPMM vulnerability as soon as available
  • Enhance monitoring and logging of network traffic related to EPMM

Action items

  • Review system logs for suspicious activity related to the affected IP address
  • Update EPMM to mitigate against newly disclosed vulnerabilities

Detection IOCs

  • IP address linked to exploitation attempts
  • Anomalous network traffic patterns from known IP addresses

Source link

https://thehackernews.com/2026/02/83-of-ivanti-epmm-exploits-linked-to.html