Beware the RESURGE: New Malware Menace Targets Ivanti Systems!
A new, stealthy malware variant, RESURGE, exploits a critical Ivanti Connect Secure vulnerability, CVE-2025-0282, to wreak havoc. It creates web shells, manipulates system files, and even survives reboots. CISA urges factory resets and credential changes to counteract RESURGE’s antics, which include injecting processes and sneaking around like a digital ninja.
Hot Take:
Seems like the RESURGE malware is taking its name quite literally, as it’s popping up like an uninvited guest at a cybersecurity party, targeting Ivanti appliances with the enthusiasm of a cat discovering a new box. What’s next? Malware named “STAYPUT” that never leaves? Stay tuned, folks, because it seems like the cybercriminals are having their own naming contest, and the entries just keep getting more creative!
Key Points:
- RESURGE malware targets Ivanti Connect Secure appliances through a critical vulnerability.
- It uses a stack-based buffer overflow flaw (CVE-2025-0282) for its dirty work.
- RESURGE shares some features with past malware but adds its own sneaky twists.
- It maintains persistence, even through system reboots, by modifying coreboot images.
- CISA is urging immediate action, offering a laundry list of cybersecurity best practices.