RESURGE Passive Rootkit — Ivanti Connect Secure CVE-2025-0282 Exploitation, CRC32 TLS Fingerprint C2, Covert SSH Channel, SPAWNCHIMERA/SPAWNSLOTH Variants, CISA MAR Update
RESURGE Passive Rootkit (TL-2026-0163), also tracked as RESURGE, is a critical-severity malware campaign scored CVSS 9, first published 2026-03-02. It is attributed to UNC5337 (China) with medium confidence, affects Ivanti Connect Secure, references 1 CVE (CVE-2025-0282), maps to 27 MITRE ATT&CK techniques (T1003, T1005, T1014), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0163
- Threat ID
- TL-2026-0163
- Also known as
- RESURGE, SPAWNCHIMERA variant, MAR-25993211-r1.v2
- Severity
- CRITICAL
- CVSS
- 9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- MALWARE
- First published
- 2026-03-02
- Last reviewed
- 2026-03-02
- Attribution
- UNC5337
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government, critical-infrastructure, defense, energy, healthcare, financial, technology
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in RESURGE Passive Rootkit
Malware and tooling: RESURGE, SPAWNCHIMERA - S9024, SPAWNSLOTH
RESURGE is a sophisticated 32-bit Linux ELF implant targeting Ivanti Connect Secure appliances via CVE-2025-0282 (CVSS 9.0). It implements a fully passive C2 architecture — hooking the web process accept() function, filtering TLS ClientHello packets via CRC32 fingerprinting, and deploying a covert libssh server over Unix domain socket. CISA updated its MAR on Feb 26, 2026 warning RESURGE may be dormant and undetected on critical infrastructure devices.
How RESURGE Passive Rootkit works
RESURGE is a sophisticated 32-bit Linux shared object (ELF) implant extracted from a compromised Ivanti Connect Secure appliance during a CISA incident response engagement on critical infrastructure. The malware functions simultaneously as a rootkit, backdoor, dropper, bootkit, proxy, and tunneler, representing one of the most advanced implants targeting network edge devices documented by CISA.
**Initial Access — CVE-2025-0282**: The attack begins with exploitation of CVE-2025-0282, a critical stack-based buffer overflow (CVSS 9.0, CWE-121/CWE-787) in the IFT (IF-T) protocol handler of Ivanti Connect Secure (before 22.7R2.5), Policy Secure (before 22.7R1.2), and Neurons for ZTA Gateways (before 22.7R2.3). The vulnerability allows unauthenticated remote code execution on internet-facing VPN appliances. Exploitation was first observed in December 2024 from Tor exit nodes and commercial VPN infrastructure, with characteristic "Invalid IFT packet received from unauthenticated client" log entries preceding successful compromise. CISA added CVE-2025-0282 to the Known Exploited Vulnerabilities catalog on January 8, 2025.
**Passive C2 Architecture — No Outbound Traffic**: Unlike conventional backdoors that beacon to external C2 servers, RESURGE implements a fully passive command and control architecture. The implant lies dormant and produces zero outbound network traffic. It activates only when a remote operator connects to the compromised device with specially crafted TLS traffic. This makes detection through traditional network monitoring (NetFlow, IDS/IPS, proxy logs) effectively impossible during the dormant phase.
**Process-Specific Behavior**: RESURGE's behavior depends on which process loads it: - When loaded by the 'web' process: hooks the accept() function to intercept all inbound TLS connections, applying CRC32-based fingerprint filtering to distinguish operator traffic from legitimate users. - When loaded by the 'dsmdm' process: deploys a statically linked libssh server that communicates via Unix domain socket at /home/runtime/tmp/.logsrv, providing full remote shell access without binding to any network port.
**CRC32 TLS Fingerprint Authentication**: The malware inspects incoming TLS ClientHello messages and computes a CRC32 hash of the random bytes field. If the hash matches a predefined value, the connection is proxied to the covert .logsrv socket. Non-matching connections are transparently forwarded to the legitimate Ivanti web server. For the ServerHello response, RESURGE generates 28 random bytes, computes their CRC32 hash, byte-swaps the result, and inserts it at the start of the ServerHello random bytes field — allowing the operator to verify they have reached the implant. After mutual verification, the operator establishes a genuine mutual TLS session using Elliptic Curve Cryptography over the P-521 curve.
**Persistence Mechanisms**: RESURGE implements multi-layered persistence: - Commands 1: Inserts itself into ld.so.preload for automatic loading at system startup. Deploys a web shell in compcheckresult.cgi (parameter "vXm8DtMJG" for command execution). Fakes integrity checks by recalculating SHA-256 hashes and re-signing the manifest file. Modifies DSUpgrade.pm to set LD_PRELOAD ensuring the library loads during upgrades. - Commands 2: Decrypts, modifies, and re-encrypts the coreboot RAM disk, achieving boot-level persistence that can survive reboots and potentially factory resets. - Commands 3: Modifies Python integrity scanning scripts (scanner.py, scanner_legacy.py) to suppress mismatch detection, preventing the device's built-in security controls from identifying tampering.
**SPAWNSLOTH Log Tampering**: An embedded module named liblogblock.so, derived from the SPAWNSLOTH malware family, hooks the dslogserver process at runtime using the Funchook library. It intercepts and manipulates log writing operations, suppressing or altering entries to remove forensic evidence of malicious activity.
**BusyBox Toolkit (dsmain)**: A 64-bit Linux ELF binary containing the BusyBox toolkit and a shell script for extracting uncompressed kernel images (vmlinux) from compromised kernel images. Provides extensive Unix utilities for file manipulation, compression, downloading, and the kernel-level operations required for coreboot RAM disk modification.
**SPAWN Malware Family Lineage**: RESURGE shares significant code and behavioral similarities with SPAWNCHIMERA, part of the SPAWN malware family that has been linked to China-nexus threat operations targeting Ivanti appliances. The SPAWN family includes SPAWNMOLE (tunneler), SPAWNSNAIL (SSH backdoor), SPAWNSLOTH (log tamper), and now RESURGE (passive rootkit with enhanced C2). Mandiant tracks related activity as UNC5337, while Palo Alto Unit 42 tracks it as CL-UNK-0979.
**CISA MAR Update — Feb 26, 2026**: CISA updated its Malware Analysis Report (MAR-25993211-r1.v2) with deeper technical analysis showing RESURGE's sophisticated network-level evasion and authentication techniques. The critical finding: RESURGE can remain latent on systems until a remote actor attempts to connect, meaning it may be dormant and undetected on Ivanti Connect Secure devices across critical infrastructure. CISA recommends factory reset using external known-clean images as the highest-confidence remediation.
**Detection Challenges**: The use of standard protocols (TLS/SSH), passive C2 (no outbound beaconing), forged certificates mimicking legitimate Ivanti infrastructure, and modular code that blends with legitimate processes makes detection extraordinarily difficult. Traditional network-based detection (IDS/IPS, NetFlow analysis, proxy monitoring) is ineffective against the dormant implant. File integrity monitoring is undermined by the manifest re-signing. Log-based detection is undermined by SPAWNSLOTH log tampering.
MITRE ATT&CK techniques used in TL-2026-0163
credential-access
T1003 OS Credential Dumping; T1552.001 Credentials In Files
collection
stealth
T1014 Rootkit; T1036.005 Match Legitimate Resource Name or Location; T1070.006 Timestomp; T1205 Traffic Signaling; T1574.006 Dynamic Linker Hijacking
lateral-movement
exfiltration
T1041 Exfiltration Over C2 Channel
discovery
T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
execution
privilege-escalation
T1068 Exploitation for Privilege Escalation
command-and-control
T1090.001 Internal Proxy; T1095 Non-Application Layer Protocol; T1572 Protocol Tunneling; T1573.002 Asymmetric Cryptography
initial-access
T1190 Exploit Public-Facing Application
impact
persistence
T1505.003 Web Shell; T1542.003 Bootkit; T1554 Compromise Host Software Binary
defense-impairment
T1553.002 Code Signing; T1685 Disable or Modify Tools; T1685.006 Clear Linux or Mac System Logs
Affected products and versions in RESURGE Passive Rootkit
- Ivanti — Connect Secure
Vulnerable versions: before 22.7R2.5
Fixed in: 22.7R2.5 - Ivanti — Policy Secure
Vulnerable versions: before 22.7R1.2
Fixed in: 22.7R1.2 - Ivanti — Neurons for ZTA Gateways
Vulnerable versions: before 22.7R2.3
Fixed in: 22.7R2.3
Remediation for RESURGE Passive Rootkit
Patches
- Ivanti Connect Secure 22.7R2.5 — fixes CVE-2025-0282
- Ivanti Policy Secure 22.7R1.2 — fixes CVE-2025-0282
- Ivanti Neurons for ZTA Gateways 22.7R2.3 — fixes CVE-2025-0282
Immediate actions
- Run Ivanti external Integrity Checker Tool (ICT) on all Connect Secure appliances
- Hunt for RESURGE IOCs: SHA256 52bbc44eb451cb5e16bf98bc5b1823d2f47a18d71f14543b460395a1c1b1aeda (libdsupgrade.so)
- Check for existence of /home/runtime/tmp/.logsrv Unix domain socket
- Check ld.so.preload for unauthorized entries
- Inspect compcheckresult.cgi for web shell code (parameter vXm8DtMJG)
- Review scanner.py and scanner_legacy.py for modifications suppressing mismatch detection
- Check DSUpgrade.pm for unauthorized LD_PRELOAD entries
- Monitor for CRC32-anomalous TLS handshakes on Ivanti appliance traffic
- Disconnect compromised Ivanti devices from network immediately
Workarounds
- Factory reset with external known-clean image before returning to service
- Use Ivanti ICT tool for ongoing integrity monitoring
- Disable cloud-joined devices to revoke device tokens if domain accounts compromised
Longer-term hardening
- Conduct factory reset using external known-clean image (CISA highest-confidence recommendation)
- Revoke and reissue all certificates, keys, and passwords exposed through compromised appliance
- Reset admin passwords, API keys, local user passwords, and service account credentials
- Reset domain account passwords twice, revoke Kerberos tickets, revoke cloud tokens
- Deploy network segmentation isolating VPN appliances from internal infrastructure
- Implement enhanced TLS inspection on Ivanti appliance traffic
- Deploy file integrity monitoring that checks against known-good baselines (not device manifest)
- Monitor for SPAWN family variants across all Ivanti products
CVEs associated with RESURGE Passive Rootkit
Weaknesses (CWE) in RESURGE Passive Rootkit
CWE-121, CWE-787
Timeline of RESURGE Passive Rootkit
- First exploitation of CVE-2025-0282 observed in the wild from Tor exit nodes and commercial VPN infrastructure. Source: https://unit42.paloaltonetworks.com/threat-brief-ivanti-cve-2025-0282-cve-2025-0283/
- Ivanti discloses CVE-2025-0282 and CVE-2025-0283 in security advisory. CISA adds CVE-2025-0282 to Known Exploited Vulnerabilities catalog same day. Mandiant publishes initial findings on UNC5337. Source: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283
- Watchtowr Labs publishes exploitation walkthrough for CVE-2025-0282. Public PoC released January 16. Source: https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/
- Watchtowr Labs releases public proof of concept exploit for CVE-2025-0282, increasing risk of widespread abuse.
- CISA publishes original MAR-25993211-r1.v1 — RESURGE Malware Analysis Report with IOCs and detection signatures. Mitigation instructions updated to address RESURGE. Source: https://www.cisa.gov/news-events/analysis-reports/ar25-087a
- CISA updates MAR to v2 (MAR-25993211-r1.v2) with deeper technical analysis of RESURGE passive C2 architecture, CRC32 TLS fingerprinting, and covert SSH channel. Key finding: RESURGE may be dormant and undetected on critical infrastructure Ivanti appliances. Source: https://www.cisa.gov/news-events/analysis-reports/ar25-087a
- Picus Security publishes detailed analysis of RESURGE malware with vendor detection signatures (CheckPoint, Cisco, Fortinet, Palo Alto, Trellix). Source: https://www.picussecurity.com/resource/resurge-malware-exploits-ivanti-connect-secure-cve-2025-0282-vulnerability
- Threadlinqs Intelligence publishes comprehensive RESURGE analysis with full MITRE mapping, IOCs, and detection coverage.
- As of 2026-05-29, RESURGE remains an active threat: CVE-2025-0282 is patched (22.7R2.5) and in CISA KEV, but CISA's 2026-02-26 MAR update calls it a "stealthy but active" implant that can lie dormant/undetected on critical-infrastructure Ivanti devices. The China-nexus actor (UNC5337/UNC5221) is still operating and Ivanti exploitation continues into 2026, warranting MONITORING.
Sources cited for RESURGE Passive Rootkit
- CISA MAR-25993211-r1.v2 — RESURGE Malware Analysis Report (Updated Feb 2026)
- CISA Mitigation Instructions for CVE-2025-0282
- Picus Security — RESURGE Malware Exploits Ivanti Connect Secure CVE-2025-0282
- Ivanti Security Advisory — CVE-2025-0282, CVE-2025-0283
- Palo Alto Unit 42 — Threat Brief CVE-2025-0282 and CVE-2025-0283
- Mandiant — Ivanti Connect Secure VPN Zero-Day Exploitation
- Watchtowr Labs — CVE-2025-0282 Exploitation Walkthrough and PoC
- CISA KEV — CVE-2025-0282 Added to Known Exploited Vulnerabilities Catalog
- NVD — CVE-2025-0282 Detail
Threats related to RESURGE Passive Rootkit
Detection coverage for TL-2026-0163
As of 2026-03-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0163 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.