CISA Warns of Resurge Malware Connected to Ivanti Vuln

CISA warns that threat actors are exploiting a critical Ivanti Connect Secure vulnerability (CVE-2025-0282) with malware dubbed "Resurge," which creates an SSH tunnel for command-and-control, deploys a web shell on the Ivanti boot disk, modifies files and integrity checks, and is used to harvest credentials, create accounts, and escalate privileges; CISA observed additional binaries (a SpawnSloth variant and a BusyBox-based embedded binary) and recommends factory resets, credential resets, access policy reviews, monitoring, and Ivanti recovery steps.