CISA Warns of RESURGE Malware Exploiting 0-Days to Breach Ivanti Connect Secure Devices

**Executive Summary:** A newly discovered malware variant called RESURGE is actively exploiting a critical Ivanti Connect Secure zero-day (CVE-2025-0282) to gain persistent, stealthy control of VPN gateway devices; the malware combines rootkit/bootkit persistence, credential harvesting, web shells, and log-tampering (SPAWNSLOTH) to maintain long-term access and evade detection, prompting a CISA warning and recommendations including factory resets, credential resets, and isolation of affected devices.