CISA Details New Malware Used in Ivanti Attacks

CISA published an advisory on exploitation of Ivanti Connect Secure CVE-2025-0282 in a critical infrastructure environment where analysts recovered three malicious files, including a new 32-bit Linux shared object named RESURGE (libdsupgrade.so) that implements a rootkit, dropper, backdoor, bootkit, proxy/tunneler, modifies files and integrity checks, and installs a web shell; CISA provided file hashes, YARA rules, and mitigation recommendations such as disabling unnecessary services, enforcing strong authentication, using host firewalls, and scanning for suspicious attachments.