83% of Ivanti EPMM Exploits Linked to Single IP on Bulletproof Hosting Infrastructure

GreyNoise and other researchers observed active exploitation of two critical Ivanti EPMM zero-days (notably CVE-2026-1281, CVSS 9.8) with 417 exploitation sessions recorded and a single PROSPERO-hosted IP responsible for ~83% of attempts; activity includes OAST DNS callbacks and a dormant in-memory Java class loader deployed to /mifs/403.jsp, indicating initial access broker tradecraft and the potential for widespread MDM compromise. Organizations are advised to patch, audit internet-facing MDM infrastructure, monitor DNS/OAST callbacks and the specified JSP path, and block the PROSPERO AS at the perimeter.