Get the latest tech news

Sleeper Shells: Attackers Are Planting Dormant Backdoors in Ivanti EPMM


A February 2026 campaign used a internal JSP path and in-memory Java class loaders to quietly seed persistent access across Ivanti EPMM deployments - then walked away. We break down the tradecraft.

None

Get the Android app

Or read this on Hacker News

Read more on:

Photo of attackers

attackers

Photo of sleeper shells

sleeper shells

Photo of ivanti epmm

ivanti epmm

Related news:

News photo

Password guessing without AI: How attackers build targeted wordlists

News photo

Ancient telnet bug happily hands out root to attackers

News photo

Ancient telnet bug happily hands out root to attackers