Cybersecurity threat intelligence company, GreyNoise, has reported an 800 percent increase in IP scanning on Ivanti VPN's Connect Secure and Pulse Secure systems over the past week, possibly indicating preparation for potential exploitation and public disclosure of vulnerabilities. Nearly a quarter of all scanning activity for Pulse Secure and Connect Secure endpoints recorded over the past 90 days happened in a single day, with a large proportion of IPs designated as 'suspicious' or 'malicious'. Ivanti's Connect Secure has been repeatedly targeted due to its role in enterprise remote access. The company advise customers to upgrade from end-of-life products to ensure system protection against known vulnerabilities.
Source: https://www.theregister.com/2025/04/25/more_ivanti_attacks_may_be/
"id": "iva758042625",
"linkid": "ivanti",
"type": "Breach",
"date": "4/2025",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"