One IP address on PROSPERO’s impregnable hosting infrastructure is responsible for a substantial portion of the exploitation attempts that target a recently revealed security weakness in Ivanti Endpoint Manager Mobile (EPMM).
Between February 1 and February 9, 2026, 417 exploitation sessions from 8 distinct source IP addresses were observed, according to threat intelligence firm GreyNoise. An estimated 346 exploitation sessions, or 83% of all attempts, have started from 193.24.123[.]42.
One of the two critical security flaws in EPMM, CVE-2026-1281 (CVSS scores: 9.8), and CVE-2026-1340, which an attacker might use to accomplish unauthenticated remote code execution, are the targets of the nefarious activity. Ivanti admitted late last month that it was aware of only a small number of customers read more about 83% of Ivanti EPMM Exploits Linked to Single IP on Bulletproof Hosting Infrastructure.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.