Hackers Actively Exploiting Ivanti EPMM Devices to Deploy Dormant Backdoors

A sneaky cyber campaign hit Ivanti Endpoint Manager Mobile (EPMM) systems starting February 4, 2026. Attackers used two critical flaws, CVE-2026-1281 and CVE-2026-1340, to slip in dormant backdoors.

Unlike fast hits that grab data or lock files with ransomware, this one stays quiet and hidden, building long-term access.

Stealthy Implants Wait Patiently

Threat actors skipped the usual chaos. They planted malware at the web path /mifs/403.jsp. This code, a Java class called base.Info from Info.java, doesn’t run right away.

It lurks in the server’s memory, avoiding the hard drive. Standard antivirus tools miss it because they scan files, not RAM.

Security firm Defused Cyber called it a “stage loader.” Alone, it’s harmless. It waits for a special HTTP request with the key k0f53cf964d387.

Only then does it decode and launch a hidden payload. The code uses odd entry points, like the equals(Object) method, to dodge security logs.

Before sleeping, it fingerprints the system, checking OS and user details to confirm it’s a good target. Experts point to Initial Access Brokers (IABs).

These hackers breach networks to stockpile access, then sell it to others for bigger attacks.

Its SHA-256 hash is 097b051c9c9138ada0d2a9fb4dfe463d358299d4bd0e81a1db2f69f32578747a. Watch for requests to /mifs/403.jsp or Base64 strings starting with yv66vg (Java magic bytes).

Silence doesn’t mean safety. If you use Ivanti EPMM, check now.

• Scan Logs: Hunt for /mifs/403.jsp hits or suspicious Base64 data.
• Restart Servers: Memory-based malware vanishes only on reboot. Patches alone won’t cut it.
• Apply Updates: Install Ivanti’s fixes for CVE-2026-1281 and CVE-2026-1340 to block new entries.

This shows why quiet threats are deadly. Attackers hold the door open, waiting for buyers. Act fast to slam it shut.

Indicators of Compromise

• Class Name: base.Info
• Source File: Info.java
• SHA-256: 097b051c9c9138ada0d2a9fb4dfe463d358299d4bd0e81a1db2f69f32578747a

Source IPs

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.