cyber.hendryadrian.com
Security News · thecyberexpress.com

CISA Says RESURGE Can Remain Dormant on Ivanti Connect Secure Devices

· Original article ↗

Summary

CISA's updated analysis says RESURGE can remain dormant on compromised Ivanti Connect Secure devices, exploiting CVE-2025-0282 and using forged TLS certificates, ECC, SSH tunnels and traffic checks to conceal access. CISA urges mitigation and threat hunting.

Key points

  • CISA says RESURGE can remain dormant on compromised Ivanti Connect Secure devices and activate when a remote actor connects.
  • The analysis says RESURGE exploits CVE-2025-0282 to gain access and establish persistence.
  • The malware reportedly uses ECC, forged TLS certificates, SSH tunnels, TLS fingerprinting and CRC32 hashing to conceal or authenticate command-and-control traffic.
  • CISA says RESURGE modifies files, manipulates integrity checks and deploys web shells to the Ivanti boot disk, complicating detection and removal.
  • CISA urges organizations to apply CVE-2025-0282 mitigation guidance, use updated indicators of compromise and conduct proactive threat hunting.

Article Details

Event Type
CISA updated malware analysis of RESURGE
Impact
RESURGE can remain dormant on compromised Ivanti Connect Secure devices and activate when a remote actor connects, enabling stealthy, persistent access and covert command-and-control. It exploits CVE-2025-0282, modifies files and integrity checks, and deploys web shells, complicating detection and removal. CISA urged organizations to apply related mitigations, use updated indicators of compromise, and conduct proactive threat hunting.

MITRE ATT&CK

T1505.003 · Web ShellThe article reports that RESURGE deploys web shells to the Ivanti boot disk.T1572 · Protocol TunnelingThe article reports that RESURGE uses SSH tunnels to maintain covert command-and-control communication.

CVE

CVE-2025-0282Ivanti · Connect Secure; Ivanti · Neurons for ZTA gateways; +1 moreThe malware exploits CVE-2025-0282 and leverages advanced ECC encryption, forged TLS certificates, SSH tunnels, and traffic fingerprinting to maintain covert command-and-control, prompting CISA to urge patching and

People

Madhu GottumukkalaIdentified as CISA Acting Director; he described the risks addressed by the updated malware analysis and the agency's decision to provide defenders with enhanced insights.Nick AndersenIdentified as CISA Executive Assistant Director for Cybersecurity; he discussed the updated analysis and its finding that RESURGE can remain dormant and undetected on Ivanti Connect Secure devices.

Malware

RESURGECISA’s updated analysis reveals RESURGE malware remains dormant on compromised Ivanti Connect Secure devices, enabling stealthy, persistent access that evades routine detection.

Vendors

IvantiCISA’s updated analysis reveals RESURGE malware remains dormant on compromised Ivanti Connect Secure devices, enabling stealthy, persistent access that evades routine detection.

Products

Ivanti Connect SecureCISA’s updated analysis reveals RESURGE malware remains dormant on compromised Ivanti Connect Secure devices, enabling stealthy, persistent access that evades routine detection.

Related Articles