Ivanti products targeted by dangerous malware yet again

Security padlock in circuit board, digital encryption concept

(Image credit: Getty Images)

CISA is warning of new malware targeting vulnerable Ivanti products
Multiple products, vulnerable to a 2024 flaw, are being targeted
The malware can create web shells, harvest credentials, and more

Multiple Ivanti products are being targeted by a piece of malware called RESURGE, a new security advisory published by the US Cybersecurity and Infrastructure Security Agency (CISA) has said, detailing both the malware and the vulnerability being exploited to deploy it.

Resurge is a variant of SPAWNCHIMERA, a piece of malware targeting Ivanti Connect Secure appliances, enabling unauthorized access and persistent control over vulnerable endpoints.

While RESURGE can also survive reboots, the malware can also create web shells, manipulate integrity checks, modify files, and use the web shells to harvest credentials, create accounts, reset passwords, and escalate permissions.

Remote code execution risks

Furthermore, RESURGE can copy the web shell to the Ivanti running boot disk and manipulate the running coreboot image.

To infect the devices with RESURGE, threat actors are abusing CVE-2025-0282, a critical stack-based buffer overflow vulnerability in Ivanti Connect Secure, Policy Secure, and Neurons for ZTA gateways. It allows remote unauthenticated attackers to execute arbitrary code, and has been exploited in the wild since mid-December 2024.

CISA added the threat to its KEV catalog in early January 2025, noting the vulnerable software includes Ivanti Connect Secure (before version 22.7R2.5), Ivanti Policy Secure (before version 22.7R1.2), and Ivanti Neurons for ZTA gateways (before version 22.7R2.3).

There are a number of things companies could do to mitigate the risk, CISA says.

“For the highest level of confidence, conduct a factory reset,” the advisory says. “For Cloud and Virtual systems, conduct a factory reset using an external known clean image of the device.”

Furthermore, users should reset credentials of privileged and non-privileged accounts, reset passwords for all domain users and all local accounts, review access policies to temporarily revoke privileges/access for affected devices, reset the relevant account credentials or access keys, and monitor related accounts, especially administrative accounts.

“We are proponents of responsible information sharing with defenders, as it is vital to build a healthier, more resilient security ecosystem," an Ivanti spokesperson told us in an emailed statement. "The patching instructions that Ivanti released on January 8, which include performing a Factory Reset, effectively remediate the vulnerability. We encourage all customers to follow these instructions immediately if they have not done so already, and to remain on the latest version (currently 22.7R2.6), which includes significant security enhancements.”

Via The Register

Ivanti warns another critical security flaw is being attacked
We've rounded up the best password managers
Take a look at our guide to the best authenticator app

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.