RESURGE Passive Rootkit — Ivanti Connect Secure CVE-2025-0282 Exploitation, CRC32 TLS Fingerprint C2, Covert SSH Channel, SPAWNCHIMERA/SPAWNSLOTH Variants, CISA MAR Update — Threadlinqs Intelligence
As of 2026-05-30, RESURGE Passive Rootkit — Ivanti Connect Secure CVE-2025-0282 Exploitation, CRC32 TLS Fingerprint C2, Covert SSH Channel, SPAWNCHIMERA/SPAWNSLOTH Variants, CISA MAR Update is a critical-severity malware threat attributed to UNC5337 (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0163 · Severity: CRITICAL · CVSS: 9 · Status: MONITORING · Category: MALWARE
Attribution: UNC5337 · China · ESPIONAGE
RESURGE is a sophisticated 32-bit Linux ELF implant targeting Ivanti Connect Secure appliances via CVE-2025-0282 (CVSS 9.0). It implements a fully passive C2 architecture — hooking the web process
RESURGE is a sophisticated 32-bit Linux shared object (ELF) implant extracted from a compromised Ivanti Connect Secure appliance during a CISA incident response engagement on critical infrastructure. The malware functions simultaneously as a rootkit, backdoor, dropper, bootkit, proxy, and tunneler, representing one of the most advanced implants targeting network edge devices documented by CISA.
**Initial Access — CVE-2025-0282**: The attack begins with exploitation of CVE-2025-0282, a critical stack-based buffer overflow (CVSS 9.0, CWE-121/CWE-787) in the IFT (IF-T) protocol handler of Ivanti Connect Secure (before 22.7R2.5), Policy Secure (before 22.7R1.2), and Neurons for ZTA Gateways (before 22.7R2.3). The vulnerability allows unauthenticated remote code execution on internet-facing VPN appliances. Exploitation was first observed in December 2024 from Tor exit nodes and commercial VPN infrastructure, with characteristic "Invalid IFT packet received from unauthenticated client" log entries preceding successful compromise. CISA added CVE-2025-0282 to the Known Exploited Vulnerabilities catalog on January 8, 2025.
**Passive C2 Architecture — No Outbound Traffic**: Unlike conventional backdoors that beacon to external C2 servers, RESURGE implements a fully passive command and control architecture. The implant lies dormant and produces zero outbound network traffic. It activates only when a remote operator connects to the compromised device with specially crafted TLS traffic. This makes detection through traditional network monitoring (NetFlow, IDS/IPS, proxy logs) effectively impossible during the dormant phase.
**Process-Specific Behavior**: RESURGE's behavior depends on which process loads it:
- When loaded by the 'web' process: hooks the accept() function to intercept all inbound TLS connections, applying CRC32-based fingerprint filtering to distinguish operator traffic from legitimate users.
- When loaded by the 'dsmdm' process: deploys a statically linked libssh server that communicates via Unix domain socket at /home/runtime/tmp/.logsrv, providing full remote shell access without binding to any network port.
**CRC32 TLS Fingerprint Authentication**: The malware inspects incoming TLS ClientHello messages and computes a CRC32 hash of the random bytes field. If the hash matches a predefined value, the connection is proxied to the covert .logsrv socket. Non-matching connections are transparently forwarded to the legitimate Ivanti web server. For the ServerHello response, RESURGE generates 28 random bytes, computes their CRC32 hash, byte-swaps the result, and inserts it at the start of the ServerHello random bytes field — allowing the operator to verify they have reached the implant. After mutual verification, the operator establishes a genuine mutual TLS session using Elliptic Curve Cryptography over the P-521 curve.
**Persistence Mechanisms**: RESURGE implements multi-layered persistence:
- Commands 1: Inserts itself into ld.so.preload for automatic loading at system startup. Deploys a web shell in compcheckresult.cgi (parameter "vXm8DtMJG" for command execution). Fakes integrity checks by recalculating SHA-256 hashes and re-signing the manifest file. Modifies DSUpgrade.pm to set LD_PRELOAD ensuring the library loads during upgrades.
- Commands 2: Decrypts, modifies, and re-encrypts the coreboot RAM disk, achieving boot-level persistence that can survive reboots and potentially factory resets.
- Commands 3: Modifies Python integrity scanning scripts (scanner.py, scanner_legacy.py) to suppress mismatch detection, preventing the device's built-in security controls from identifying tampering.
**SPAWNSLOTH Log Tampering**: An embedded module named liblogblock.so, derived from the SPAWNSLOTH malware family, hooks the dslogserver process at runtime using the Funchook library. It intercepts and manipulates log writing operations, suppressing or altering entries to remove forensic evidence of malicious activity.
**BusyBox Too
Weaknesses (CWE)
CWE-121, CWE-787
Target sectors: government, critical-infrastructure, defense, energy, healthcare, financial, technology
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, CRITICAL, threat intelligence, cybersecurity, CVE-2025-0282, T1190, T1059.004, T1505.003, T1505.003, T1574.006, T1542.003, T1554, T1574.006, T1068, T1070.002