One threat actor responsible for 83% of recent Ivanti RCE attacks

Threat intelligence from GreyNoise and vendor reporting shows active, automated exploitation of critical Ivanti EPMM RCE flaws (CVE-2026-21962, CVE-2026-24061) between Feb 1–9, with 417 observed exploitation sessions and a single bulletproof-hosted IP (193.24.123.42) accounting for ~83% of activity; many sessions used OAST DNS callbacks consistent with initial-access brokering. Ivanti released hotfixes and recommended mitigations while planning full patches in EPMM 12.8.0.0.