CISA has issued an updated malware analysis report warning that the RESURGE malware can remain dormant and undetected on Ivanti Connect Secure devices for extended periods.

Key Warning Details

• Passive Command-and-Control (C2): RESURGE is engineered for extreme persistence, remaining latent on compromised systems until a remote actor initiates a connection.
• Evasion Techniques: The malware evades routine scans and monitoring by using advanced cryptographic methods and forged TLS certificates to facilitate covert communications.
• Persistent Threats: CISA notes that the implant can modify coreboot firmware images and manipulate filesystem contents, allowing it to survive reboots and system updates.
• Vulnerability Exploitation: RESURGE primarily exploits CVE-2025-0282, a critical stack-based buffer overflow vulnerability (CVSS 9.0) in Ivanti products.

Recommended Actions

1. Conduct Factory Resets: For the highest level of confidence, CISA recommends a factory reset of affected devices using a known clean image.
2. Use Updated IoCs: Organizations should use the latest Indicators of Compromise (IoCs) and detection signatures provided in the CISA Malware Analysis Report (MAR) to identify dormant infections.
3. Reset Credentials: Change all passwords for both privileged and non-privileged accounts, including rotating the krbtgt account twice.
4. Patch Immediately: Ensure all Ivanti appliances are updated to the latest firmware version, as detailed in the Ivanti Security Advisory.