RESURGE Passive Rootkit — Ivanti Connect Secure CVE-2025-0282 Exploitation, CRC32 TLS Fingerprint C2, Covert SSH Channel, SPAWNCHIMERA/SPAWNSLOTH Variants, CISA MAR Update

Key facts for RESURGE Ivanti rootkit

Detection coverage for RESURGE Ivanti rootkit

As of 2026-03-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0163 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: RESURGE C2/Lateral — CRC32 TLS Fingerprint C2 + Covert SSH via Unix Socket + Credential Exfiltration

Detects RESURGE passive C2 and lateral movement: (1) TLS handshake anomalies — P-521 ECC cipher suite on Ivanti appliance (normally P-256). (2) Unix domain socket .logsrv creation at /home/runtime/tmp/ — covert libssh server with no network port. (3) Coreboot RAM disk modification — boot-level persistence surviving reboot and factory reset. (4) LDAP/VPN/TLS/Kerberos credential access by non-standard processes on Ivanti appliance. (5) dsmain BusyBox toolkit (SHA256: b1221000) — kernel extraction utility for bootkit deployment.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1205, T1572, T1573.002, T1090.001, T1021.004, T1542.003, T1495
• Severity: critical
• Confidence: high

Splunk SPL

index=network sourcetype="tls:*" OR sourcetype="zeek:ssl"
| search (
    (server_name="*ivanti*" AND cipher_suite="*P-521*")
    OR (server_name="*ivanti*" AND cipher_suite="*secp521r1*")
)
| eval indicator="p521_ecc_anomaly_ivanti"
| append [
    search index=osquery OR index=fim sourcetype="fim:*" OR sourcetype="auditd"
    | search (
        (file_path="*/home/runtime/tmp/.logsrv*")
        OR (file_path="*dsmain*" OR file_hash="b1221000f43734436ec8022caaa34b133f4581ca3ae8eccd8d57ea62573f301d")
        OR (file_path="*coreboot*" AND (action="modified" OR action="read"))
    )
    | eval indicator=case(
        match(file_path, ".logsrv"), "covert_ssh_unix_socket",
        match(file_path, "dsmain"), "busybox_toolkit_deployed",
        match(file_path, "coreboot"), "bootkit_ramdisk_modification",
        1=1, "unknown"
    )
]
| stats count earliest(_time) as first_seen by host, indicator, src_ip, file_path
| eval first_seen=strftime(first_seen, "%Y-%m-%dT%H:%M:%S")
| table first_seen, host, indicator, src_ip, file_path, count

Microsoft KQL

union
(
    CommonSecurityLog
    | where TimeGenerated > ago(24h)
    | where DeviceProduct has "Ivanti"
    | where AdditionalExtensions has "P-521" or AdditionalExtensions has "secp521r1"
    | extend Indicator = "p521_ecc_anomaly"
    | project TimeGenerated, DeviceName, Indicator, SourceIP, DestinationIP
),
(
    Syslog
    | where TimeGenerated > ago(24h)
    | where SyslogMessage has "/home/runtime/tmp/.logsrv"
    | extend Indicator = "covert_ssh_socket"
    | project TimeGenerated, HostName, Indicator, SyslogMessage
),
(
    DeviceFileEvents
    | where TimeGenerated > ago(24h)
    | where FileName =~ "dsmain"
        or SHA256 == "b1221000f43734436ec8022caaa34b133f4581ca3ae8eccd8d57ea62573f301d"
    | extend Indicator = "busybox_toolkit"
    | project TimeGenerated, DeviceName, Indicator, FileName, FolderPath
)
| sort by TimeGenerated asc

Sigma

title: RESURGE — Covert Unix Domain Socket .logsrv for libssh C2 Channel
id: c3850003-0163-4003-c003-000000000003
status: experimental
description: Detects creation or access of hidden Unix domain socket at /home/runtime/tmp/.logsrv — RESURGE covert libssh server providing remote shell access without binding to any network port. Passive C2 architecture with zero outbound traffic.
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/03/02
tags:
    - attack.command_and_control
    - attack.t1205
    - attack.t1572
    - attack.t1573.002
    - attack.t1090.001
    - attack.lateral_movement
    - attack.t1021.004
    - cve.2025.0282
references:
    - https://www.cisa.gov/news-events/analysis-reports/ar25-087a
logsource:
    product: linux
    category: file_event
detection:
    selection_socket:
        filepath|contains: '/home/runtime/tmp/.logsrv'
    selection_dsmain:
        filename: 'dsmain'
    selection_bootkit:
        filepath|contains: 'coreboot'
        action|contains|any:
            - 'modified'
            - 'decrypt'
            - 'encrypt'
    condition: selection_socket or selection_dsmain or selection_bootkit
falsepositives:
    - None — .logsrv is a RESURGE-specific covert C2 socket path
level: critical

• 🔒 RESURGE Exploitation — CISA IOC Hash Match + LD_PRELOAD Hijack + IFT Protocol Anomaly · unlock with TL Creds
• 🔒 RESURGE Post-Exploitation — Coreboot Bootkit + Manifest Re-Signing + Upgrade Persistence · unlock with TL Creds
• 🔒 RESURGE C2/Lateral — Credential Harvesting + SSH Lateral Movement + Passive Exfiltration · unlock with TL Creds
• 🔒 RESURGE Exploitation — LD_PRELOAD Hijacking + Implant Library Deployment on Linux Appliance · unlock with TL Creds
• 🔒 RESURGE Post-Exploitation — SPAWNSLOTH Funchook Log Interception + Integrity Scanner Tampering · unlock with TL Creds
• 🔒 RESURGE C2/Lateral — TLS Traffic Signaling + P-521 ECC Anomaly + Passive C2 Architecture Indicators · unlock with TL Creds
• 🔒 RESURGE Exploitation — CVE-2025-0282 IFT Buffer Overflow + Implant Deployment on Ivanti Appliance · unlock with TL Creds
• 🔒 RESURGE Post-Exploitation — Web Shell + SPAWNSLOTH Log Tampering + Integrity Check Bypass · unlock with TL Creds

Indicators of compromise for RESURGE Ivanti rootkit

As of 2026-03-02, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-0163.

Sample indicators (3 of 20)

• File hash: 52bbc44eb451cb5e16bf98bc5b1823d2f47a18d71f14543b460395a1c1b1aeda
• File hash: 3526af9189533470bc0e90d54bafb0db7bda784be82a372ce112e361f7c7b104
• File hash: b1221000f43734436ec8022caaa34b133f4581ca3ae8eccd8d57ea62573f301d

Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.

How RESURGE Ivanti rootkit works

CISA updated its MAR on Feb 26, 2026 warning RESURGE may be dormant and undetected on critical infrastructure devices.

RESURGE is a sophisticated 32-bit Linux shared object (ELF) implant extracted from a compromised Ivanti Connect Secure appliance during a CISA incident response engagement on critical infrastructure. The malware functions simultaneously as a rootkit, backdoor, dropper, bootkit, proxy, and tunneler, representing one of the most advanced implants targeting network edge devices documented by CISA.

**Initial Access — CVE-2025-0282**: The attack begins with exploitation of CVE-2025-0282, a critical stack-based buffer overflow (CVSS 9.0, CWE-121/CWE-787) in the IFT (IF-T) protocol handler of Ivanti Connect Secure (before 22.7R2.5), Policy Secure (before 22.7R1.2), and Neurons for ZTA Gateways (before 22.7R2.3). The vulnerability allows unauthenticated remote code execution on internet-facing VPN appliances. Exploitation was first observed in December 2024 from Tor exit nodes and commercial VPN infrastructure, with characteristic "Invalid IFT packet received from unauthenticated client" log entries preceding successful compromise. CISA added CVE-2025-0282 to the Known Exploited Vulnerabilities catalog on January 8, 2025.

**Passive C2 Architecture — No Outbound Traffic**: Unlike conventional backdoors that beacon to external C2 servers, RESURGE implements a fully passive command and control architecture. The implant lies dormant and produces zero outbound network traffic. It activates only when a remote operator connects to the compromised device with specially crafted TLS traffic. This makes detection through traditional network monitoring (NetFlow, IDS/IPS, proxy logs) effectively impossible during the dormant phase.

**Process-Specific Behavior**: RESURGE's behavior depends on which process loads it: - When loaded by the 'web' process: hooks the accept() function to intercept all inbound TLS connections, applying CRC32-based fingerprint filtering to distinguish operator traffic from legitimate users. - When loaded by the 'dsmdm' process: deploys a statically linked libssh server that communicates via Unix domain socket at /home/runtime/tmp/.logsrv, providing full remote shell access without binding to any network port.

**CRC32 TLS Fingerprint Authentication**: The malware inspects incoming TLS ClientHello messages and computes a CRC32 hash of the random bytes field. If the hash matches a predefined value, the connection is proxied to the covert .logsrv socket. Non-matching connections are transparently forwarded to the legitimate Ivanti web server. For the ServerHello response, RESURGE generates 28 random bytes, computes their CRC32 hash, byte-swaps the result, and inserts it at the start of the ServerHello random bytes field — allowing the operator to verify they have reached the implant. After mutual verification, the operator establishes a genuine mutual TLS session using Elliptic Curve Cryptography over the P-521 curve.

**Persistence Mechanisms**: RESURGE implements multi-layered persistence: - Commands 1: Inserts itself into ld.so.preload for automatic loading at system startup. Deploys a web shell in compcheckresult.cgi (parameter "vXm8DtMJG" for command execution). Fakes integrity checks by recalculating SHA-256 hashes and re-signing the manifest file. Modifies DSUpgrade.pm to set LD_PRELOAD ensuring the library loads during upgrades. - Commands 2: Decrypts, modifies, and re-encrypts the coreboot RAM disk, achieving boot-level persistence that can survive reboots and potentially factory resets. - Commands 3: Modifies Python integrity scanning scripts (scanner.py, scanner_legacy.py) to suppress mismatch detection, preventing the device's built-in security controls from identifying tampering.

**SPAWNSLOTH Log Tampering**: An embedded module named liblogblock.so, derived from the SPAWNSLOTH malware family, hooks the dslogserver process at runtime using the Funchook library. It intercepts and manipulates log writing operations, suppressing or altering entries to remove forensic evidence of malicious activity.

**BusyBox Toolkit (dsmain)**: A 64-bit Linux ELF binary containing the BusyBox toolkit and a shell script for extracting uncompressed kernel images (vmlinux) from compromised kernel images. Provides extensive Unix utilities for file manipulation, compression, downloading, and the kernel-level operations required for coreboot RAM disk modification.

**SPAWN Malware Family Lineage**: RESURGE shares significant code and behavioral similarities with SPAWNCHIMERA, part of the SPAWN malware family that has been linked to China-nexus threat operations targeting Ivanti appliances. The SPAWN family includes SPAWNMOLE (tunneler), SPAWNSNAIL (SSH backdoor), SPAWNSLOTH (log tamper), and now RESURGE (passive rootkit with enhanced C2). Mandiant tracks related activity as UNC5337, while Palo Alto Unit 42 tracks it as CL-UNK-0979.

**CISA MAR Update — Feb 26, 2026**: CISA updated its Malware Analysis Report (MAR-25993211-r1.v2) with deeper technical analysis showing RESURGE's sophisticated network-level evasion and authentication techniques. The critical finding: RESURGE can remain latent on systems until a remote actor attempts to connect, meaning it may be dormant and undetected on Ivanti Connect Secure devices across critical infrastructure. CISA recommends factory reset using external known-clean images as the highest-confidence remediation.

**Detection Challenges**: The use of standard protocols (TLS/SSH), passive C2 (no outbound beaconing), forged certificates mimicking legitimate Ivanti infrastructure, and modular code that blends with legitimate processes makes detection extraordinarily difficult. Traditional network-based detection (IDS/IPS, NetFlow analysis, proxy monitoring) is ineffective against the dormant implant. File integrity monitoring is undermined by the manifest re-signing. Log-based detection is undermined by SPAWNSLOTH log tampering.

MITRE ATT&CK techniques by tactic:

credential-access

T1003 OS Credential Dumping; T1552.001 Credentials In Files

collection

T1005 Data from Local System

stealth

T1014 Rootkit; T1036.005 Match Legitimate Resource Name or Location; T1070.006 Timestomp; T1205 Traffic Signaling; T1574.006 Dynamic Linker Hijacking

lateral-movement

T1021.004 SSH

exfiltration

T1041 Exfiltration Over C2 Channel

discovery

T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

execution

T1059.004 Unix Shell

privilege-escalation

T1068 Exploitation for Privilege Escalation

command-and-control

T1090.001 Internal Proxy; T1095 Non-Application Layer Protocol; T1572 Protocol Tunneling; T1573.002 Asymmetric Cryptography

initial-access

T1190 Exploit Public-Facing Application

impact

T1495 Firmware Corruption

persistence

T1505.003 Web Shell; T1542.003 Bootkit; T1554 Compromise Host Software Binary

defense-impairment

T1553.002 Code Signing; T1685 Disable or Modify Tools; T1685.006 Clear Linux or Mac System Logs

Remediation for RESURGE Ivanti rootkit

Patches

• Ivanti Connect Secure 22.7R2.5 — fixes CVE-2025-0282
• Ivanti Policy Secure 22.7R1.2 — fixes CVE-2025-0282
• Ivanti Neurons for ZTA Gateways 22.7R2.3 — fixes CVE-2025-0282

Immediate actions

• Run Ivanti external Integrity Checker Tool (ICT) on all Connect Secure appliances
• Hunt for RESURGE IOCs: SHA256 52bbc44eb451cb5e16bf98bc5b1823d2f47a18d71f14543b460395a1c1b1aeda (libdsupgrade.so)
• Check for existence of /home/runtime/tmp/.logsrv Unix domain socket
• Check ld.so.preload for unauthorized entries
• Inspect compcheckresult.cgi for web shell code (parameter vXm8DtMJG)
• Review scanner.py and scanner_legacy.py for modifications suppressing mismatch detection
• Check DSUpgrade.pm for unauthorized LD_PRELOAD entries
• Monitor for CRC32-anomalous TLS handshakes on Ivanti appliance traffic
• Disconnect compromised Ivanti devices from network immediately

Workarounds

• Factory reset with external known-clean image before returning to service
• Use Ivanti ICT tool for ongoing integrity monitoring
• Disable cloud-joined devices to revoke device tokens if domain accounts compromised

Longer-term hardening

• Conduct factory reset using external known-clean image (CISA highest-confidence recommendation)
• Revoke and reissue all certificates, keys, and passwords exposed through compromised appliance
• Reset admin passwords, API keys, local user passwords, and service account credentials
• Reset domain account passwords twice, revoke Kerberos tickets, revoke cloud tokens
• Deploy network segmentation isolating VPN appliances from internal infrastructure
• Implement enhanced TLS inspection on Ivanti appliance traffic
• Deploy file integrity monitoring that checks against known-good baselines (not device manifest)
• Monitor for SPAWN family variants across all Ivanti products

Affected and fixed versions

• Ivanti — Connect Secure
  Vulnerable versions: before 22.7R2.5
  Fixed in: 22.7R2.5
• Ivanti — Policy Secure
  Vulnerable versions: before 22.7R1.2
  Fixed in: 22.7R1.2
• Ivanti — Neurons for ZTA Gateways
  Vulnerable versions: before 22.7R2.3
  Fixed in: 22.7R2.3

Timeline of RESURGE Ivanti rootkit

• 2024-12-01 First exploitation of CVE-2025-0282 observed in the wild from Tor exit nodes and commercial VPN infrastructure. Source: https://unit42.paloaltonetworks.com/threat-brief-ivanti-cve-2025-0282-cve-2025-0283/
• 2025-01-08 Ivanti discloses CVE-2025-0282 and CVE-2025-0283 in security advisory. CISA adds CVE-2025-0282 to Known Exploited Vulnerabilities catalog same day. Mandiant publishes initial findings on UNC5337. Source: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283
• 2025-01-12 Watchtowr Labs publishes exploitation walkthrough for CVE-2025-0282. Public PoC released January 16. Source: https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/
• 2025-01-16 Watchtowr Labs releases public proof of concept exploit for CVE-2025-0282, increasing risk of widespread abuse.
• 2025-03-28 CISA publishes original MAR-25993211-r1.v1 — RESURGE Malware Analysis Report with IOCs and detection signatures. Mitigation instructions updated to address RESURGE. Source: https://www.cisa.gov/news-events/analysis-reports/ar25-087a
• 2026-02-26 CISA updates MAR to v2 (MAR-25993211-r1.v2) with deeper technical analysis of RESURGE passive C2 architecture, CRC32 TLS fingerprinting, and covert SSH channel. Key finding: RESURGE may be dormant and undetected on critical infrastructure Ivanti appliances. Source: https://www.cisa.gov/news-events/analysis-reports/ar25-087a
• 2026-02-28 Picus Security publishes detailed analysis of RESURGE malware with vendor detection signatures (CheckPoint, Cisco, Fortinet, Palo Alto, Trellix). Source: https://www.picussecurity.com/resource/resurge-malware-exploits-ivanti-connect-secure-cve-2025-0282-vulnerability
• 2026-03-02 Threadlinqs Intelligence publishes comprehensive RESURGE analysis with full MITRE mapping, IOCs, and detection coverage.
• 2026-05-29 As of 2026-05-29, RESURGE remains an active threat: CVE-2025-0282 is patched (22.7R2.5) and in CISA KEV, but CISA's 2026-02-26 MAR update calls it a "stealthy but active" implant that can lie dormant/undetected on critical-infrastructure Ivanti devices. The China-nexus actor (UNC5337/UNC5221) is still operating and Ivanti exploitation continues into 2026, warranting MONITORING.

Sources cited for RESURGE Ivanti rootkit

• CISA MAR-25993211-r1.v2 — RESURGE Malware Analysis Report (Updated Feb 2026) CISA · Government advisory · 2026-02-26
• CISA Mitigation Instructions for CVE-2025-0282 CISA · Advisory · 2025-03-28
• CISA KEV — CVE-2025-0282 Added to Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2025-01-08
• NVD — CVE-2025-0282 Detail NVD (NIST) · Advisory · 2025-01-08
• Picus Security — RESURGE Malware Exploits Ivanti Connect Secure CVE-2025-0282 picussecurity.com · Research · 2026-02-28
• Ivanti Security Advisory — CVE-2025-0282, CVE-2025-0283 Ivanti · Vendor report · 2025-01-08
• Palo Alto Unit 42 — Threat Brief CVE-2025-0282 and CVE-2025-0283 Unit 42 · Research · 2025-01-16
• Mandiant — Ivanti Connect Secure VPN Zero-Day Exploitation Google Cloud · Research · 2025-01-08
• Watchtowr Labs — CVE-2025-0282 Exploitation Walkthrough and PoC labs.watchtowr.com · Proof of concept · 2025-01-12

Threats related to RESURGE Ivanti rootkit

• Velvet Ant (China-Nexus) 'Operation Highland' — Backdoored pam_unix.so PAM Module and Trojanized OpenSSH for Decade-Long Credential Theft in an Isolated Network
• Velvet Ant (Operation Highland): Backdoored Linux PAM and OpenSSH for ~Decade-Long Espionage Persistence

Other reports on CVE-2025-0282

• Operation Escaneo: MexicanMafia (PanchoVilla) Intrusion Campaign Against Mexican Government Agencies and Latin American Financial Institutions
• ARMORY CASTLE Zero-Day Exploitation of BeyondTrust Remote Support (CVE-2026-102764) with SAWFLY Webshell and BARECLAW Tunneler
• Sen. Wyden Urges Binding Federal Mandate to Purge Internet-Facing Legacy VPNs for Zero-Trust Remote Access

Previous and next in malware

• Tesseract OCR Typosquat Campaign — ClickFix Multi-Stage Malware Targeting Developers via Fake OCR Tool Sites with PowerShell Payload Chaining and Defense Evasion Previous report
• XWorm v6.4 Delivery Campaign — Obfuscated JavaScript/PowerShell Loaders with ProcessHollowing DLL Injection (March 2026) Next report