Ivanti exploitation: what GreyNoise says defenders may be missing

TL;DR: 83% of observed exploitation of two critical Ivanti EPMM flaws traces to one bulletproof-hosting IP that is absent from widely shared IOC lists, according to GreyNoise, while several circulated indicators show zero Ivanti activity and instead point to unrelated Oracle WebLogic scanning. That mismatch means IOC-only blocking can leave the primary exploitation source untouched.

Editorial analysis by NHI Mgmt Group, based on content published by GreyNoise: “Active Ivanti Exploitation Traced to Single Bulletproof IP—Published IOC Lists Point Elsewhere”.

By the numbers:

• 83% of observed exploitation comes from one IP on bulletproof hosting.
• GreyNoise recorded 417 exploitation sessions from 8 unique source IPs between February 1 and February 9.
• 85% of exploitation payloads triggered out-of-band DNS callbacks to verify command execution.

Key questions

Q: What breaks when teams rely on published IOCs without campaign validation?

A: They can block low-confidence infrastructure while leaving the main exploitation source untouched.

Q: Why does unauthenticated RCE against mobile device management systems create such high risk?

A: Because the management server sits close to device enrollment, policy enforcement, and administrative control.

Q: What signs suggest an exploitation campaign is staging access instead of finishing compromise?

A: Out-of-band callbacks, low-volume probing followed by sharp spikes, and the absence of a deployed second-stage payload all point to staging rather than immediate impact.

Practitioner guidance

• Validate IOC provenance before enforcement Separate indicators tied to the Ivanti exploitation path from shared VPN exits or unrelated scanning sources before adding them to blocklists.
• Hunt for OAST callback evidence Review DNS telemetry for high-entropy subdomains and unique callback patterns that indicate the exploit executed on target systems.
• Treat EPMM as privileged infrastructure Segment mobile device management servers from general internet exposure and restrict administrative reachability to trusted network paths.

Bottom line: The campaign shows that published indicators can be directionally useful but still miss the infrastructure actually driving exploitation.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →