[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQbLxHeV4JpcVuFCZhQqlPaKnOPsZ6g0g_Rs35P82x2g":3,"$f36kF1rk9gCBZ5UeF5HUQqj7mBcgMD-ekDSNWkpbTDKI":49},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":46,"created_at":47,"updated_at":48,"published_at":35},"greynoise-labs-reveals-34k-sessions-scanning-ivanti-connect-secure-for-cve-2025-","GreyNoise Labs reveals 34k+ sessions scanning Ivanti Connect Secure for CVE-2025-0282","High-volume cluster runs on Limited Network LTD (AS213790) in Romania\u002FMoldova with a 100x baseline spike.","Two parallel reconnaissance campaigns are scanning internet-facing Ivanti Connect Secure instances for CVE-2025-0282, with the high-volume cluster concentrated in AS213790 (Limited Network LTD) and the second campaign distributed across ~6,000 unique IPs.",[10,11,12,13,14,15],"Ivanti Connect Secure","CVE-2025-0282","GreyNoise Labs","AS213790","Limited Network LTD","RCE","# GreyNoise Labs reveals 34k+ sessions scanning Ivanti Connect Secure for CVE-2025-0282\n\n*High-volume cluster runs on Limited Network LTD (AS213790) in Romania\u002FMoldova with a 100x baseline spike.*\n\n**Tags:** `Ivanti Connect Secure` `CVE-2025-0282` `GreyNoise Labs` `AS213790` `Limited Network LTD` `RCE`\n\n> Two parallel reconnaissance campaigns are scanning internet-facing Ivanti Connect Secure instances for CVE-2025-0282, with the high-volume cluster concentrated in AS213790 (Limited Network LTD) and the second campaign distributed across ~6,000 unique IPs.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2025-0282 | 9.0 | 100.0% | ✅ listed | available | 86.5 (Critical) |\n\n## Two parallel campaigns scanning Ivanti for CVE-2025-0282\n\nGreyNoise Labs has observed more than 34,000 active sessions across two parallel scanning campaigns targeting Ivanti Connect Secure for CVE-2025-0282, representing a 100x spike over the provider’s baseline traffic.\n\nBoth campaigns are hunting the same vulnerability: a stack-based buffer overflow in Ivanti Connect Secure prior to version 22.7R2.5 that allows a remote unauthenticated attacker to achieve code execution. The CVE carries a CVSS 3.1 score of 9.0, an EPSS score of 100.0% (100th percentile), is listed in CISA’s Known Exploited Vulnerabilities catalog, and has a public proof-of-concept available.\n\nCampaign 1 is the high-volume cluster, concentrated in AS213790 operated by Limited Network LTD. The geographic footprint is clustered in Romania and Moldova, a pattern consistent with the provider’s prior reconnaissance work. The burst pattern suggests automated tooling running at full throttle, likely racing to enumerate targets before patches deploy.\n\nCampaign 2 takes the distributed approach: roughly 6,000 unique IPs spread across multiple ASNs and geographies, with no single provider dominating the traffic. The distribution is consistent with botnet infrastructure, residential proxy networks, or multi-cloud deployment. Pacing is lower and steadier than Campaign 1, indicating a different operator profile.\n\n## The AS213790 cluster: Limited Network LTD in Romania\u002FMoldova\n\nThe high-volume cluster sits in AS213790, operated by Limited Network LTD, a recurring recon provider that has appeared in prior scanning campaigns. The geographic footprint is concentrated in Romania and Moldova, a pattern consistent with the provider’s prior work. The burst pattern indicates automated tooling running at full throttle, likely racing to enumerate targets before patches deploy.\n\n## The distributed campaign: 6,000 IPs across multiple ASNs\n\nCampaign 2 takes the distributed approach: roughly 6,000 unique IPs spread across multiple ASNs and geographies, with no single provider dominating the traffic. The distribution is consistent with botnet infrastructure, residential proxy networks, or multi-cloud deployment. Pacing is lower and steadier than Campaign 1, indicating a different operator profile.\n\n## CVE-2025-0282: stack-based buffer overflow in Ivanti Connect Secure\n\nIvanti has assigned CVE-2025-0282 to a stack-based buffer overflow in Connect Secure, Policy Secure, and Neurons for ZTA gateways. The flaw affects Connect Secure versions prior to 22.7R2.5, Policy Secure before 22.7R1.2, and Neurons for ZTA before 22.7R2.3. A remote unauthenticated attacker can trigger the overflow to achieve code execution on the gateway.\n\nThe vulnerability carries a CVSS 3.1 score of 9.0, an EPSS score of 100.0% at the 100th percentile, and is listed in CISA’s Known Exploited Vulnerabilities catalog. A public proof-of-concept is available. The PRS risk score sits at 86.5 (Critical), and 11 products are affected.\n\n## What to look for in logs and network exposure\n\nExternal requests to `\u002Fdana-na\u002Fauth\u002Furl_default\u002Fwelcome.cgi` deserve scrutiny. That endpoint is the unauthenticated entry point for the stack-based buffer overflow, and it is the path the scanner hits first. If you see it in your access logs from an IP that is not your own, you have a candidate for CVE-2025-0282.\n\nEvery internet-facing Ivanti instance is potentially on a target list. The AS213790 cluster is running at full throttle, which means the operator is enumerating before the patch window closes. If your Connect Secure is still on 22.7R2.4 or earlier, the overflow is live. The EPSS at 100.0% and the KEV listing confirm the exploit is in the wild, not just in the lab.\n\nPatch status matters now. Exploitation is a matter of when, not if. The CVSS 9.0 and the public PoC mean the RCE is trivial to trigger once the request lands. If you are not on 22.7R2.5 for Connect Secure, 22.7R1.2 for Policy Secure, or 22.7R2.3 for Neurons for ZTA, you are in the 11 affected products. The PRS risk at 86.5 (Critical) reflects the unauthenticated remote code execution on the gateway.\n\n## Key points\n\n- Two parallel campaigns generated 34k+ sessions with a 100x baseline spike scanning for CVE-2025-0282.\n- Campaign 1 (high-volume) is concentrated in AS213790 operated by Limited Network LTD, geographically clustered in Romania and Moldova.\n- Campaign 2 (distributed) uses ~6,000 unique IPs across multiple ASNs and geographies, consistent with botnet, residential proxies, or multi-cloud deployment.\n- CVE-2025-0282 is a stack-based buffer overflow in Ivanti Connect Secure \u003C 22.7R2.5, Policy Secure \u003C 22.7R1.2, and Neurons for ZTA \u003C 22.7R2.3 allowing unauthenticated RCE (CVSS 9.0, EPSS 100%, KEV, PoC available).\n- Exploit path is \u002Fdana-na\u002Fauth\u002Furl_default\u002Fwelcome.cgi; every internet-facing Ivanti instance is a target until patched.\n\n## Further reading & sources\n\n- [Inside the Infrastructure: Who’s Scanning for Ivanti Connect Secure? – GreyNoise Labs](https:\u002F\u002Fwww.labs.greynoise.io\u002Fgrimoire\u002F2026-01-29-inside-the-infrastructure-whos-scanning-for-ivanti-connect-secure) — GreyNoise Labs\n- [Hunting New C2 Frameworks - Part 2 - Nexus C2, Shipped with Creds](https:\u002F\u002Fnewtonpaul.com\u002Fblog\u002Fhunting-ai-generated-c2-part_2)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgreynoise-labs-reveals-34k-sessions-scanning-ivanti-connect-secure-for-cve-2025-.png?v=ea7577722f",{"cves":19,"iocs":28,"targets":31,"technologies":36},[20],{"id":11,"kev":21,"poc":21,"url":22,"cvss":23,"epss":24,"risk_band":25,"risk_score":26,"cvss_version":27},true,"\u002Fvulnerabilities\u002FCVE-2025-0282",9,0.9998,"Critical",86.5,"3.1",[29],{"type":30,"value":13},"other",[32],{"name":10,"sector":33,"status":34,"geography":35},"Networking \u002F VPN","targeted",null,[37,39,42,44],{"vendor":38,"product":10},"Ivanti",{"vendor":40,"product":41},"Nexus C2","Nexus C2 Panel",{"vendor":40,"product":43},"abe_helper.dll",{"vendor":40,"product":45},"client.exe","campaign","2026-09-14T07:09:53.792428+00:00","2026-10-16T12:28:39.736403+00:00",{"articles":50},[51,63,74,86],{"slug":52,"title":53,"summary":54,"tags":55,"hero_image_url":60,"story_type":61,"created_at":62},"274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570","274 Zimbra Servers Compromised in the Wild via CVE-2026-73570","Shadowserver found 274 internet-facing Zimbra Collaboration Suite servers compromised in-the-wild via CVE-2026-73570, an unauthenticated OS command injection in the zimbra-snmp package that lets attackers execute arbitrary commands as the zimbra user via crafted SMTP requests.",[56,57,15,58,59],"Zimbra","CVE-2026-73570","CISA KEV","Shadowserver","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002F274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570.png?v=9273e873d2","exploitation","2026-09-24T07:12:41.74195+00:00",{"slug":64,"title":65,"summary":66,"tags":67,"hero_image_url":71,"story_type":72,"created_at":73},"cisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline","CISA KEV adds N-Able N-Central RCE with 3-day federal deadline","CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog for N-able N-central, an unauthenticated authentication bypass that grants remote administrative access on versions through 2026.1, with a 3-day federal deadline and active in-the-wild exploitation.",[68,69,58,15,70],"CVE-2026-18556","N-Able N-Central","authentication bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline.png?v=584a02fe66","vulnerability_disclosure","2026-09-21T12:03:34.769619+00:00",{"slug":75,"title":76,"summary":77,"tags":78,"hero_image_url":84,"story_type":72,"created_at":85},"gitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di","Gitea RCE CVE-2026-60004: Unauthenticated Attackers Execute Shell Commands via diffpatch","Gitea disclosed CVE-2026-60004, a critical remote code execution vulnerability in the diffpatch feature that allows unauthenticated remote attackers to write malicious Git hooks and execute arbitrary shell commands as the Gitea process user on default installations with open self-registration enabled.",[79,80,15,81,82,83],"Gitea","CVE-2026-60004","diffpatch","Git hooks","CVSS 9.8","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di.png?v=b4d72a9b81","2026-09-12T12:07:21.883073+00:00",{"slug":87,"title":88,"summary":89,"tags":90,"hero_image_url":96,"story_type":72,"created_at":97},"jetbrains-teamcity-rce-cve-2026-63077-exposed-via-runzero-asset-discovery","JetBrains TeamCity RCE (CVE-2026-63077) Exposed via RunZero Asset Discovery","JetBrains TeamCity On-Premises before 2023.05.4 has an authentication bypass (CWE-288) that lets an unauthenticated remote attacker execute arbitrary code on the server, enabling supply-chain compromise of CI\u002FCD builds.",[91,92,93,15,94,95],"JetBrains","TeamCity","CVE-2023-42793","CI\u002FCD","RunZero","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fjetbrains-teamcity-rce-cve-2026-63077-exposed-via-runzero-asset-discovery.png?v=e72ab95e44","2026-09-12T07:13:03.260727+00:00"]