Ivanti products targeted by dangerous malware yet again

LovabledanielsApril 1, 202553 Views

CISA is warning of new malware targeting vulnerable Ivanti products
Multiple products, vulnerable to a 2024 flaw, are being targeted
The malware can create web shells, harvest credentials, and more

Multiple Ivanti products are being targeted by a piece of malware called RESURGE, a new security advisory published by the US Cybersecurity and Infrastructure Security Agency (CISA) has said, detailing both the malware and the vulnerability being exploited to deploy it.

Resurge is a variant of SPAWNCHIMERA, a piece of malware targeting Ivanti Connect Secure appliances, enabling unauthorized access and persistent control over vulnerable endpoints.

While RESURGE can also survive reboots, the malware can also create web shells, manipulate integrity checks, modify files, and use the web shells to harvest credentials, create accounts, reset passwords, and escalate permissions.

Remote code execution risks

Furthermore, RESURGE can copy the web shell to the Ivanti running boot disk and manipulate the running coreboot image.

To infect the devices with RESURGE, threat actors are abusing CVE-2025-0282, a critical stack-based buffer overflow vulnerability in Ivanti Connect Secure, Policy Secure, and Neurons for ZTA gateways. It allows remote unauthenticated attackers to execute arbitrary code, and has been exploited in the wild since mid-December 2024.

CISA added the threat to its KEV catalog in early January 2025, noting the vulnerable software includes Ivanti Connect Secure (before version 22.7R2.5), Ivanti Policy Secure (before version 22.7R1.2), and Ivanti Neurons for ZTA gateways (before version 22.7R2.3).

There are a number of things companies could do to mitigate the risk, CISA says.

“For the highest level of confidence, conduct a factory reset,” the advisory says. “For Cloud and Virtual systems, conduct a factory reset using an external known clean image of the device.”

Furthermore, users should reset credentials of privileged and non-privileged accounts, reset passwords for all domain users and all local accounts, review access policies to temporarily revoke privileges/access for affected devices, reset the relevant account credentials or access keys, and monitor related accounts, especially administrative accounts.

Via The Register