CISA Details How RESURGE Malware Stays Dormant on Ivanti Devices
Summary
CISA’s updated analysis says RESURGE can remain dormant on compromised Ivanti Connect Secure devices, activating only for inbound TLS traffic matching a CRC32 fingerprint and forged Ivanti certificate. It also details persistence and log-tampering components.
Key points
- CISA says RESURGE was deployed on Ivanti Connect Secure devices through exploitation of CVE-2025-0282 as a zero-day.
- The implant, identified as libdsupgrade.so, waits for a specific inbound TLS connection rather than beaconing to its command-and-control server.
- It checks incoming traffic using CRC32 TLS fingerprinting and a forged Ivanti certificate; CISA says the certificate may also serve as a network signature for detecting compromise.
- After authentication, the actor establishes remote access through a mutually authenticated TLS session using elliptic-curve cryptography, according to CISA.
- A RESURGE-contained SpawnSloth variant, liblogblock.so, is used for log tampering; dsmain supports modifying firmware and filesystem contents for boot-level persistence.
- CISA says dormant infections may remain undetected and advises administrators to use updated indicators of compromise to find and remove them.
- Mandiant researchers reportedly linked the exploitation to UNC5221, a threat actor described as linked to China.
Article Details
- Attack Vectors
- Exploitation of CVE-2025-0282 as a zero-day to compromise Ivanti Connect Secure devices.
- RESURGE remains latent until it receives a specific inbound TLS connection that matches its CRC32 TLS fingerprint check.
- The implant uses a forged Ivanti certificate to authenticate connections and impersonate the legitimate server.
- Defensive Notes
- CISA advises administrators to use its updated indicators of compromise to find and remove dormant RESURGE infections from Ivanti devices.
- CISA says the forged certificate is sent unencrypted and may be used as a network signature to detect an active compromise.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 3526af9189533470bc0e90d54bafb0db7bda784be82a372ce112e361f7c7b104 | Hash of the liblogblock.so SpawnSloth variant contained by RESURGE. |
| SHA256 | 52bbc44eb451cb5e16bf98bc5b1823d2f47a18d71f14543b460395a1c1b1aeda | Hash of the RESURGE implant file libdsupgrade.so extracted from a compromised device. |
| SHA256 | b1221000f43734436ec8022caaa34b133f4581ca3ae8eccd8d57ea62573f301d | Hash of dsmain, a kernel-extraction script analyzed as part of the RESURGE infection. |
MITRE ATT&CK
T1001.003 · Protocol or Service ImpersonationThe article says the implant mimics legitimate TLS/SSH traffic to achieve stealth.T1014 · RootkitRESURGE is described as having rootkit capabilities.T1036 · MasqueradingThe actor uses a forged Ivanti certificate to impersonate the legitimate server.T1068 · Exploitation for Privilege EscalationCISA previously reported that RESURGE can escalate privileges.T1070.002 · Clear Linux or Mac System LogsThe liblogblock.so SpawnSloth variant is used to tamper with logs and hide activity on compromised devices.T1090 · ProxyRESURGE is described as having proxying capabilities.T1136 · Create AccountCISA previously reported that RESURGE can create accounts on compromised devices.T1190 · Exploit Public-Facing ApplicationThe article reports that RESURGE was deployed after exploitation of the CVE-2025-0282 zero-day on Ivanti Connect Secure devices.T1505.003 · Web ShellCISA previously reported that RESURGE can create webshells on compromised devices.T1542.001 · System Firmwaredsmain enables modification of coreboot firmware images for boot-level persistence.T1572 · Protocol TunnelingRESURGE is described as supporting tunneling.T1573.002 · Asymmetric CryptographyThe implant establishes a mutual TLS session using an Elliptic Curve protocol and verifies the remote actor's EC key against a hard-coded EC certificate authority key.
CVE
Threat Actors
Malware
RESURGECISA has released new technical details on RESURGE, a persistent implant that exploited the CVE-2025-0282 zero-day to compromise Ivanti Connect Secure devices.SPAWNSLOTHand a forged Ivanti certificate is received, and includes components like libdsupgrade.so, a SpawnSloth variant (liblogblock.so), and dsmain for persistence and log tampering.