Cyber-Attacks Target Vulnerable Ivanti Products

Cyble reports active exploitation attempts against Ivanti Endpoint Manager Mobile (EPMM) and Ivanti Sentry exploiting multiple CVEs (including CVE-2023-35078 and CVE-2023-35081). Sensors observed GET/POST requests targeting vulnerable endpoints, use of compromised SOHO routers as proxies, public forum activity offering a zero-day, and notable internet exposure concentrated in the United States and Germany; the report includes IoCs, ATT&CK mappings, and remediation recommendations.