New Malware Variant RESURGE Exploits Ivanti Vulnerability

CISA has uncovered RESURGE, a sophisticated malware variant exploiting a stack-based buffer overflow (CVE-2025-0282) in Ivanti Connect Secure/Policy Secure/ZTA Gateway appliances to embed web shells, alter coreboot and kernel images for persistence, inject into legitimate processes, create SSH tunnels for C2, and evade integrity checks; the agency published YARA/SIGMA rules, recommended urgent mitigations (factory resets, credential resets, privilege restrictions), and noted links to SPAWNCHIMERA/SPAWNSLOTH tools and active exploitation.