Full Report
Shadowserver scans have identified 86 compromised instances, and researchers warn multiple threat groups are involved. The post Fallout from latest Ivanti zero-days spreads to nearly 100 victims appeared first on CyberScoop.
Analysis Summary
# Incident Report: Widespread Exploitation Following Ivanti EPMM Zero-Days
## Executive Summary
Multiple threat groups actively exploited two critical Ivanti Endpoint Manager Mobile (EPMM) zero-day vulnerabilities (CVE-2026-1281 and CVE-2026-1340), leading to widespread compromise. As of the reporting date, Shadowserver scans identified 86 confirmed compromised instances, including major government agencies like the Dutch Data Protection Authority and the Council for the Judiciary, alongside the European Commission. Attackers sought rapid remote code execution, leading to the deployment of webshells and reverse shells across numerous unpatched systems.
## Incident Details
- Discovery Date: Between Jan 29, 2026 (vendor disclosure) and Feb 9, 2026 (Shadowserver reporting)
- Incident Date: Attacks observed "in-the-wild" prior to Jan 29, 2026 disclosure.
- Affected Organization: At least 86 organizations identified by Shadowserver, including major entities like the Netherlands’ Dutch Data Protection Authority, Council for the Judiciary, and the European Commission.
- Sector: Government, Public Administration (Broader scope likely given technology deployed).
- Geography: Global (Implied by multinational victims and Shadowserver scope).
## Timeline of Events
### Initial Access
- Date/Time: Pre-Jan 29, 2026 (Observed "in-the-wild" prior to disclosure).
- Vector: Exploitation of Ivanti EPMM zero-day vulnerabilities CVE-2026-1281 and CVE-2026-1340.
- Details: These vulnerabilities allow unauthenticated remote code execution (CVSS 9.8).
### Lateral Movement
- Details: Multiple threat groups appear active. Post-compromise activity observed includes deployment of webshells and artifact installation patterns consistent with multiple actors overwriting or co-existing.
### Data Exfiltration/Impact
- Impact: Execution of system commands and deployment of remote access tools (webshells, reverse shells) indicating system compromise for persistence and potential data access. Specific data impact is not detailed.
### Detection & Response
- Detection: Discovery primarily driven by:
1. Ivanti’s initial disclosure (Jan 29).
2. External threat hunting (Shadowserver scans using initial artifacts, Rapid7 honeypot analysis).
- Response Actions: Ivanti released IoCs and a detection script (Friday following disclosure). The Netherlands’ NCSC contributed to the script’s development.
## Attack Methodology
- Initial Access: Remote Code Execution (RCE) via Ivanti EPMM vulnerabilities (CVE-2026-1281, CVE-2026-1340).
- Persistence: Deployment of webshells and reverse shells observed by researchers.
- Privilege Escalation: Not explicitly detailed, but successful RCE likely grants high-level access on the EPMM server.
- Defense Evasion: Multiple threat groups are noted, suggesting varied tactics are employed to maintain presence.
- Credential Access: Not detailed.
- Discovery: Not detailed beyond initial exploitation artifacts.
- Lateral Movement: Activity suggests actors are attempting to expand access post-initial compromise.
- Collection: Implied by the deployment of secondary access tools.
- Exfiltration: Not detailed.
- Impact: Remote system control via code execution.
## Impact Assessment
- Financial: Not specified, but mounting pressure on major agencies suggests potential significant remediation costs.
- Data Breach: Confirmed compromise of systems managing mobile devices for significant government bodies (e.g., EU Commission, Dutch authorities), implying potential sensitivity.
- Operational: Disruption and mandatory incident response activities for affected governmental and enterprise customers.
- Reputational: Public acknowledgement of successful attacks against high-profile government entities.
## Indicators of Compromise
- Network Indicators: Numerous IP addresses observed attempting exploitation (from Rapid7 honeypot: 130+ unique IPs).
- File Indicators: Webshells and payload droppers deployed post-exploitation (observed by Shadowserver/Rapid7).
- Behavioral Indicators: Remote system command execution artifacts identified via Shadowserver scanning. (Specific IoCs are proprietary or pending public release).
## Response Actions
- Containment: Not explicitly detailed, but assumed remediation efforts included patching the Ivanti EPMM systems and isolating compromised segments.
- Eradication: Customers advised to hunt for and remove deployed webshells/malware using vendor-supplied detection scripts.
- Recovery: Restoration of affected services and hardening of configurations.
## Lessons Learned
- Patch Velocity is Critical: Attacks began "in-the-wild" before the vendor disclosed the issue (Jan 29), highlighting the danger posed by pre-disclosure exploitation.
- Visibility Gap: Despite vendor advisories, the true scale of compromise was significantly larger (86 confirmed + ongoing activity) than initially acknowledged.
- Multi-Actor Targeting: A successful zero-day exploit attracts diverse threat actors immediately following public disclosure and exploit code availability.
## Recommendations
- Organizations utilizing Ivanti EPMM must prioritize immediate patching for CVE-2026-1281 and CVE-2026-1340.
- Implement rigorous security monitoring focused on anomalous outbound connections from endpoints, specifically looking for webshell activity or reverse shell beacons targeting vulnerable servers.
- Proactively utilize vendor-supplied detection scripts and threat intelligence feeds to hunt for known exploitation artifacts on all internet-facing assets, even before official vendor alerts are fully processed.