Urgent Alert: New Malware Exploits Ivanti Zero-Day Vulnerability

Urgent Alert: New Malware Exploits Ivanti Zero-Day Vulnerability

The short version:

• The Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert about new malware tied to an Ivanti zero-day.
• The flaw, CVE-2025-0282, affects Ivanti Connect Secure and related gateway products that many organizations use for remote access.
• CISA recommends patching, a factory reset for the highest confidence, and resetting credentials.
• CISA and Ivanti are working with security researchers to contain the threat.

RESURGE and the Ivanti flaw

On March 28, 2025, CISA published a malware analysis report on a new variant it calls RESURGE. Attackers dropped it on an Ivanti Connect Secure appliance at a critical infrastructure organization after exploiting CVE-2025-0282, a stack-based buffer overflow that CISA added to its Known Exploited Vulnerabilities catalog on January 8, 2025.

RESURGE shares capabilities with the SPAWNCHIMERA malware, including surviving reboots. CISA says it can create a web shell and tamper with integrity checks. It also copies a web shell to the appliance’s running boot disk. Reboots alone will not clear it. Because these appliances sit at the network edge, an attacker who controls one can harvest credentials and reach deeper into the network.

What CISA tells defenders to do

CISA wants organizations running these Ivanti products to act now. Its mitigation guidance calls for running Ivanti’s external Integrity Checker Tool, hunting on systems connected to the device and applying Ivanti’s patch. For the highest confidence, it recommends a factory reset.

If a device was compromised, CISA says to disconnect it, report to CISA and Ivanti, and reset passwords for privileged and non-privileged accounts. That includes resetting the krbtgt account twice.

Who else is responding

Security researchers and Ivanti have published indicators and detection signatures to help defenders find RESURGE. CISA has stressed coordination with vendors and victims.

Vendors are also adding AI and machine-learning detection to their products, aiming to spot unusual activity on edge devices before attackers do real damage.

Edge devices remain a favorite target

Attackers keep going after VPN and gateway appliances. These devices are exposed to the internet and sit in front of everything else, so a single unpatched box can let attackers in.

The RESURGE report is one more case. Patching alone may not remove malware that is already on a device, which is why CISA’s guidance focuses on resets and credential changes.

Teams running Ivanti Connect Secure should check their version against Ivanti’s advisory, run the Integrity Checker Tool and review CISA’s indicators of compromise this week.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.