Sleeping with the Enemy: Dormant Backdoors Found in Ivanti EPMM

A stealthy espionage campaign has been observed exploiting two Ivanti EPMM flaws (CVE-2026-1281 and CVE-2026-1340) to install a dormant, in-memory Java class loader at /mifs/403.jsp that does nothing until a specific trigger; researchers attribute the activity to Initial Access Brokers preparing validated access for later sale or activation. The implant leaves minimal forensic traces, so the advisory provides IoCs (requests to /mifs/403.jsp, large Base64 starting with yv66vg, parameter name k0f53cf964d387, and response markers like ERROR:// and 3cd3d/e60537) and recommends restarting affected application servers and treating any signs as confirmed compromise.