Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Inside the Infrastructure: Who’s Scanning for Ivanti Connect Secure?
Excerpt
Between January 21st and 28th, GreyNoise sensors observed reconnaissance activity against Ivanti Connect Secure jump roughly 100x above historical baselines (nope! not a typo!! 100x!!!). What made this spike interesting wasn’t just the volume—it was the structure. We’re tracking two distinct campaigns running in parallel, each with different infrastructure, pacing, and apparent objectives. During this time, GreyNoise tracked two distinct campaigns targeting Ivanti Connect…
Read the original report →Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2025-0282 | High | Score 63/100 | First seen |
| CVE | CVE-2025-0283 | Medium | Score 54/100 | First seen |
IOC Relationship Graph
Building graph…