Loading story…
CSO Online reported active exploitation of Ivanti Endpoint Manager Mobile (EPMM) zero-day vulnerabilities being used to seize control of mobile device management (MDM) servers, potentially enabling attackers to compromise device fleets managed through affected deployments. The coverage frames the activity as in-the-wild exploitation of previously unknown flaws impacting enterprise mobility infrastructure.
Separately, CSO Online also described Arkanix, an information-stealing malware family that combines fast data collection via Python components with stealthier C++ payloads, reflecting a modular approach to credential and data theft. Other items in the provided material (an NSFOCUS write-up on AI-related prompt-injection style incidents and a Security Affairs malware-newsletter roundup) do not provide corroborating reporting on the Ivanti EPMM exploitation or the Arkanix stealer and appear to be broader, multi-topic content rather than coverage of the same specific event.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
On February 24, 2026, reporting based on Kaspersky research revealed Arkanix's dual architecture: rapid Python-based harvesting paired with stealthier native C++ payloads. The analysis also described its data theft scope, exfiltration methods, and command-and-control infrastructure.
After its brief campaign, Arkanix's affiliate program was shut down and its infrastructure, including two Cloudflare-fronted domains hosting a protected panel, was taken offline. The takedown was consistent with the malware operation's short lifespan.
By February 2026, attackers were reported to be actively exploiting zero-day vulnerabilities in Ivanti EPMM to take control of mobile device management servers. The reporting indicates live compromise of exposed MDM infrastructure.
Arkanix Stealer appeared in late 2025 as a short-lived information-stealing malware operation. Kaspersky later assessed it as likely an AI/LLM-assisted development experiment built for a rapid, limited campaign rather than a sustained criminal service.
In October 2025, operators promoted Arkanix Stealer on dark web forums as a malware-as-a-service offering. The ads described a control panel, configurable payloads, and a Discord server used as the main communications channel.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcecsoonline.com
Open sourcecsoonline.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Ivanti Endpoint Manager Mobile (EPMM)** is being actively exploited via two critical, unauthenticated remote code execution vulnerabilities, **CVE-2026-1281** and **CVE-2026-1340** (both reported as CVSS 9.8). Reporting describes attackers achieving full control of exposed EPMM/MDM infrastructure, including establishing reverse shells, deploying web shells, performing reconnaissance, and downloading additional malware; activity has been observed across multiple countries and sectors (including government, healthcare, manufacturing, and technology). **CISA added CVE-2026-1281 to the Known Exploited Vulnerabilities (KEV) Catalog**, and defenders are urged to apply Ivanti’s available fixes/updates per the vendor advisory. Telemetry and threat-intel observations indicate broad internet exposure and automation in exploitation. Unit 42 reported visibility into **4,400+** EPMM instances, and noted threat actors shifting from initial exploitation toward **dormant backdoors** intended to preserve access even after patching. GreyNoise data highlighted that a large share of observed exploitation traffic (reported as **83%**) originated from a single IP, `193.24.123.42`, associated with “bulletproof” hosting, with attackers rotating user-agent strings consistent with mass scanning/exploitation; the same infrastructure was also linked to attempts against other products (e.g., Oracle WebLogic, `telnetd`, and GLPI).
Jun 29, 2026
Threat actors exploited two zero-day vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), tracked as **CVE-2026-1281** and **CVE-2026-1340**. The incidents add to recurring exploitation of Ivanti EPMM and Connect Secure appliances, which remain attractive entry points for both state-sponsored and financially motivated operators. A joint Tenable and SentinelOne analysis found that disparate actor groups converge on the same edge and remote-access vendors even when they use different vulnerabilities: its dataset covered 82 CVEs and 93 actor-attribution pairs, with only 21% CVE overlap but 79% vendor overlap. Organizations should prioritize patching internet-facing Ivanti and other edge devices, reduce exposed attack surface, enforce edge-specific remediation SLAs, and use endpoint controls to limit post-compromise lateral movement.
Aug 26, 2026
Ivanti warned that two critical zero-day flaws in **Endpoint Manager Mobile (EPMM)** — `CVE-2026-1281` and `CVE-2026-1340` — were being actively exploited, and subsequent reporting described rapid mass exploitation after proof-of-concept code became public. The attacks hit internet-facing EPMM systems used to manage mobile devices, with incident responders documenting a fully automated intrusion chain that successfully exfiltrated sensitive EPMM data and leveraged lesser-known product behaviors alongside an open-source offensive framework. Germany's BSI also issued an alert on active attacks, underscoring the broad operational impact of the campaign. The exploitation wave affected both opportunistic victims and targeted organizations, including governments. Dutch authorities disclosed that attackers had maintained access to the Dutch Custodial Institutions Agency's EPMM server for about five months, exposing employee names, email addresses, phone numbers, and location data, with officials warning of elevated blackmail and extortion risks. Ivanti's earlier handling of **EPMM** flaws, including `CVE-2023-35082`, had already shown that internet-exposed deployments could enable unauthorized access to personally identifiable information, but the company separately clarified that a later May 2026 advisory for **Endpoint Manager (EPM)** — covering `CVE-2026-8109`, `CVE-2026-8110`, and `CVE-2026-8111` — involved a different product and was not tied to the EPMM zero-day exploitation.
Aug 31, 2026