CISA Alerts on RESURGE Malware Exploiting Ivanti Connect Secure Zero-Days

The Cybersecurity and Infrastructure Security Agency (CISA) has released a Malware Analysis Report (MAR) detailing a new malware family dubbed RESURGE, which is actively exploiting a zero-day vulnerability in Ivanti Connect Secure devices.

According to CISA, RESURGE builds upon the functionality of the earlier SPAWNCHIMERA malware strain, introducing new commands designed to enhance persistence and expand its capabilities for credential theft and privilege escalation.

However, it goes beyond simple persistence techniques by executing new distinctive commands that manipulate system integrity checks and core security operations.

CISA warns that RESURGE can:

• Create and deploy web shells within Ivanti systems.
• Manipulate integrity checks to evade detection.
• Modify critical files while the system is running.
• Facilitate credential harvesting, account creation, password resets, and privilege escalation.

The malware also copies web shells directly to the Ivanti device’s boot disk. It alters the coreboot image, ensuring it remains active even after reboot or partial restoration.

In its analysis, CISA found that RESURGE incorporates several advanced functions similar to SPAWNCHIMERA, including the ability to survive system reboots.

These stealthy modifications make RESURGE extremely difficult to detect and remove using standard remediation processes.

Linked to Ivanti CVE-2025-0282 Exploitation

CISA has linked these intrusions to the exploitation of CVE-2025-0282, a stack-based buffer overflow vulnerability in Ivanti Connect Secure, Policy Secure, and ZTA Gateway products.

This flaw, first added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog on January 8, 2025, allows remote attackers to execute arbitrary code and gain persistent access to targeted systems.

The agency’s MAR, MAR-25993211.R1.V1.CLEAR provides technical details, YARA detection rules, and associated SIGMA signatures for identifying the malware in networks. These detection tools are publicly available on the CISA portal for security teams to implement rapidly.

CISA urges organizations to act immediately, emphasizing that simply patching the vulnerability may not remove the implant. For maximum assurance, administrators should:

• Perform a full factory reset of all affected appliances.
• For cloud or virtual systems, use a known clean external image to reset devices.
• Follow Ivanti’s Recommended Recovery Steps for device restoration.

In addition to these remediation measures, CISA advises:

• Resetting credentials for privileged and non-privileged accounts.
• Enforcing password resets for all domain and local accounts, including Guest, HelpAssistant, System, Administrator, and especially krbtgt (used for Kerberos ticket encryption). The krbtgt password should be reset twice, with full replication between resets to prevent authentication failures.
• Reviewing and potentially revoking or reducing account privileges on affected systems to prevent reinfection or lateral movement.

CISA’s Eviction Guidance from the post-SolarWinds compromise era, which remains relevant for networks facing Advanced Persistent Threat (APT)-style intrusions involving Active Directory compromises.

Defensive Guidance

If it is operationally necessary to avoid alerting attackers for instance, during threat intelligence collection CISA recommends temporarily reducing privileges instead of performing immediate resets.

Administrators should continue to monitor privileged accounts for any abnormal or unauthorized access attempts.

Security teams can refer to the full CISA malware report MAR-25993211.R1.V1.CLEAR and download associated SIGMA rules for updated detection.

CISA’s guidance stresses that persistent access through RESURGE could allow attackers to return even after patching unless complete remediation and credential resets are performed.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.