# RESURGE Passive Rootkit — Ivanti Connect Secure CVE-2025-0282 Exploitation, CRC32 TLS Fingerprint C2, Covert SSH Channel, SPAWNCHIMERA/SPAWNSLOTH Variants, CISA MAR Update

> RESURGE is a sophisticated 32-bit Linux ELF implant targeting Ivanti Connect Secure appliances via CVE-2025-0282 (CVSS 9.0). It implements a fully passive C2 architecture — hooking the web process accept() function, filtering TLS ClientHello packets via CRC32 fingerprinting, and deploying a covert libssh server over Unix domain socket. CISA updated its MAR on Feb 26, 2026 warning RESURGE may be dormant and undetected on critical infrastructure devices.

- **Published:** 2026-03-02T05:21:00Z
- **Last reviewed:** 2026-03-02T05:21:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0163
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-resurge-ivanti-rootkit-tl-2026-0163.webp?v=7712d7bc (Threadlinqs threat intel: RESURGE Ivanti Rootkit: Detection & IOCs (TL-2026-0163) — Critical severity, 20 IOCs, 9 detection rules.)
- **ID:** TL-2026-0163
- **Severity:** CRITICAL (CVSS 9)
- **Category:** MALWARE
- **Status:** MONITORING
- **Actor:** UNC5337 (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (3 shown free below)
- **CVEs:** CVE-2025-0282

## Description

RESURGE is a sophisticated 32-bit Linux shared object (ELF) implant extracted from a compromised Ivanti Connect Secure appliance during a CISA incident response engagement on critical infrastructure. The malware functions simultaneously as a rootkit, backdoor, dropper, bootkit, proxy, and tunneler, representing one of the most advanced implants targeting network edge devices documented by CISA.

**Initial Access — CVE-2025-0282**: The attack begins with exploitation of CVE-2025-0282, a critical stack-based buffer overflow (CVSS 9.0, CWE-121/CWE-787) in the IFT (IF-T) protocol handler of Ivanti Connect Secure (before 22.7R2.5), Policy Secure (before 22.7R1.2), and Neurons for ZTA Gateways (before 22.7R2.3). The vulnerability allows unauthenticated remote code execution on internet-facing VPN appliances. Exploitation was first observed in December 2024 from Tor exit nodes and commercial VPN infrastructure, with characteristic "Invalid IFT packet received from unauthenticated client" log entries preceding successful compromise. CISA added CVE-2025-0282 to the Known Exploited Vulnerabilities catalog on January 8, 2025.

**Passive C2 Architecture — No Outbound Traffic**: Unlike conventional backdoors that beacon to external C2 servers, RESURGE implements a fully passive command and control architecture. The implant lies dormant and produces zero outbound network traffic. It activates only when a remote operator connects to the compromised device with specially crafted TLS traffic. This makes detection through traditional network monitoring (NetFlow, IDS/IPS, proxy logs) effectively impossible during the dormant phase.

**Process-Specific Behavior**: RESURGE's behavior depends on which process loads it:
- When loaded by the 'web' process: hooks the accept() function to intercept all inbound TLS connections, applying CRC32-based fingerprint filtering to distinguish operator traffic from legitimate users.
- When loaded by the 'dsmdm' process: deploys a statically linked libssh server that communicates via Unix domain socket at /home/runtime/tmp/.logsrv, providing full remote shell access without binding to any network port.

**CRC32 TLS Fingerprint Authentication**: The malware inspects incoming TLS ClientHello messages and computes a CRC32 hash of the random bytes field. If the hash matches a predefined value, the connection is proxied to the covert .logsrv socket. Non-matching connections are transparently forwarded to the legitimate Ivanti web server. For the ServerHello response, RESURGE generates 28 random bytes, computes their CRC32 hash, byte-swaps the result, and inserts it at the start of the ServerHello random bytes field — allowing the operator to verify they have reached the implant. After mutual verification, the operator establishes a genuine mutual TLS session using Elliptic Curve Cryptography over the P-521 curve.

**Persistence Mechanisms**: RESURGE implements multi-layered persistence:
- Commands 1: Inserts itself into ld.so.preload for automatic loading at system startup. Deploys a web shell in compcheckresult.cgi (parameter "vXm8DtMJG" for command execution). Fakes integrity checks by recalculating SHA-256 hashes and re-signing the manifest file. Modifies DSUpgrade.pm to set LD_PRELOAD ensuring the library loads during upgrades.
- Commands 2: Decrypts, modifies, and re-encrypts the coreboot RAM disk, achieving boot-level persistence that can survive reboots and potentially factory resets.
- Commands 3: Modifies Python integrity scanning scripts (scanner.py, scanner_legacy.py) to suppress mismatch detection, preventing the device's built-in security controls from identifying tampering.

**SPAWNSLOTH Log Tampering**: An embedded module named liblogblock.so, derived from the SPAWNSLOTH malware family, hooks the dslogserver process at runtime using the Funchook library. It intercepts and manipulates log writing operations, suppressing or altering entries to remove forensic evidence of malicious activity.

**BusyBox Toolkit (dsmain)**: A 64-bit Linux ELF binary containing the BusyBox toolkit and a shell script for extracting uncompressed kernel images (vmlinux) from compromised kernel images. Provides extensive Unix utilities for file manipulation, compression, downloading, and the kernel-level operations required for coreboot RAM disk modification.

**SPAWN Malware Family Lineage**: RESURGE shares significant code and behavioral similarities with SPAWNCHIMERA, part of the SPAWN malware family that has been linked to China-nexus threat operations targeting Ivanti appliances. The SPAWN family includes SPAWNMOLE (tunneler), SPAWNSNAIL (SSH backdoor), SPAWNSLOTH (log tamper), and now RESURGE (passive rootkit with enhanced C2). Mandiant tracks related activity as UNC5337, while Palo Alto Unit 42 tracks it as CL-UNK-0979.

**CISA MAR Update — Feb 26, 2026**: CISA updated its Malware Analysis Report (MAR-25993211-r1.v2) with deeper technical analysis showing RESURGE's sophisticated network-level evasion and authentication techniques. The critical finding: RESURGE can remain latent on systems until a remote actor attempts to connect, meaning it may be dormant and undetected on Ivanti Connect Secure devices across critical infrastructure. CISA recommends factory reset using external known-clean images as the highest-confidence remediation.

**Detection Challenges**: The use of standard protocols (TLS/SSH), passive C2 (no outbound beaconing), forged certificates mimicking legitimate Ivanti infrastructure, and modular code that blends with legitimate processes makes detection extraordinarily difficult. Traditional network-based detection (IDS/IPS, NetFlow analysis, proxy monitoring) is ineffective against the dormant implant. File integrity monitoring is undermined by the manifest re-signing. Log-based detection is undermined by SPAWNSLOTH log tampering.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1505.003 Web Shell
- T1574.006 Dynamic Linker Hijacking
- T1542.003 Bootkit
- T1554 Compromise Host Software Binary
- T1068 Exploitation for Privilege Escalation
- T1685.006 Clear Linux or Mac System Logs
- T1070.006 Timestomp
- T1685 Disable or Modify Tools
- T1553.002 Code Signing
- T1036.005 Match Legitimate Resource Name or Location
- T1014 Rootkit
- T1003 OS Credential Dumping
- T1552.001 Credentials In Files
- T1082 System Information Discovery
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1021.004 SSH
- T1005 Data from Local System
- T1090.001 Internal Proxy
- T1572 Protocol Tunneling
- T1573.002 Asymmetric Cryptography
- T1095 Non-Application Layer Protocol
- T1205 Traffic Signaling
- T1041 Exfiltration Over C2 Channel
- T1495 Firmware Corruption

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**RESURGE C2/Lateral — CRC32 TLS Fingerprint C2 + Covert SSH via Unix Socket + Credential Exfiltration** (`TL-2026-0163-SPL-003`)

Detects RESURGE passive C2 and lateral movement: (1) TLS handshake anomalies — P-521 ECC cipher suite on Ivanti appliance (normally P-256). (2) Unix domain socket .logsrv creation at /home/runtime/tmp/ — covert libssh server with no network port. (3) Coreboot RAM disk modification — boot-level persistence surviving reboot and factory reset. (4) LDAP/VPN/TLS/Kerberos credential access by non-standard processes on Ivanti appliance. (5) dsmain BusyBox toolkit (SHA256: b1221000) — kernel extraction utility for bootkit deployment.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1205, T1572, T1573.002, T1090.001, T1021.004, T1542.003, T1495
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=network sourcetype="tls:*" OR sourcetype="zeek:ssl"
| search (
    (server_name="*ivanti*" AND cipher_suite="*P-521*")
    OR (server_name="*ivanti*" AND cipher_suite="*secp521r1*")
)
| eval indicator="p521_ecc_anomaly_ivanti"
| append [
    search index=osquery OR index=fim sourcetype="fim:*" OR sourcetype="auditd"
    | search (
        (file_path="*/home/runtime/tmp/.logsrv*")
        OR (file_path="*dsmain*" OR file_hash="b1221000f43734436ec8022caaa34b133f4581ca3ae8eccd8d57ea62573f301d")
        OR (file_path="*coreboot*" AND (action="modified" OR action="read"))
    )
    | eval indicator=case(
        match(file_path, ".logsrv"), "covert_ssh_unix_socket",
        match(file_path, "dsmain"), "busybox_toolkit_deployed",
        match(file_path, "coreboot"), "bootkit_ramdisk_modification",
        1=1, "unknown"
    )
]
| stats count earliest(_time) as first_seen by host, indicator, src_ip, file_path
| eval first_seen=strftime(first_seen, "%Y-%m-%dT%H:%M:%S")
| table first_seen, host, indicator, src_ip, file_path, count
```

### Microsoft KQL

```kql
union
(
    CommonSecurityLog
    | where TimeGenerated > ago(24h)
    | where DeviceProduct has "Ivanti"
    | where AdditionalExtensions has "P-521" or AdditionalExtensions has "secp521r1"
    | extend Indicator = "p521_ecc_anomaly"
    | project TimeGenerated, DeviceName, Indicator, SourceIP, DestinationIP
),
(
    Syslog
    | where TimeGenerated > ago(24h)
    | where SyslogMessage has "/home/runtime/tmp/.logsrv"
    | extend Indicator = "covert_ssh_socket"
    | project TimeGenerated, HostName, Indicator, SyslogMessage
),
(
    DeviceFileEvents
    | where TimeGenerated > ago(24h)
    | where FileName =~ "dsmain"
        or SHA256 == "b1221000f43734436ec8022caaa34b133f4581ca3ae8eccd8d57ea62573f301d"
    | extend Indicator = "busybox_toolkit"
    | project TimeGenerated, DeviceName, Indicator, FileName, FolderPath
)
| sort by TimeGenerated asc
```

### Sigma

```yaml
title: RESURGE — Covert Unix Domain Socket .logsrv for libssh C2 Channel
id: c3850003-0163-4003-c003-000000000003
status: experimental
description: Detects creation or access of hidden Unix domain socket at /home/runtime/tmp/.logsrv — RESURGE covert libssh server providing remote shell access without binding to any network port. Passive C2 architecture with zero outbound traffic.
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/03/02
tags:
    - attack.command_and_control
    - attack.t1205
    - attack.t1572
    - attack.t1573.002
    - attack.t1090.001
    - attack.lateral_movement
    - attack.t1021.004
    - cve.2025.0282
references:
    - https://www.cisa.gov/news-events/analysis-reports/ar25-087a
logsource:
    product: linux
    category: file_event
detection:
    selection_socket:
        filepath|contains: '/home/runtime/tmp/.logsrv'
    selection_dsmain:
        filename: 'dsmain'
    selection_bootkit:
        filepath|contains: 'coreboot'
        action|contains|any:
            - 'modified'
            - 'decrypt'
            - 'encrypt'
    condition: selection_socket or selection_dsmain or selection_bootkit
falsepositives:
    - None — .logsrv is a RESURGE-specific covert C2 socket path
level: critical
```

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- RESURGE Exploitation — CISA IOC Hash Match + LD_PRELOAD Hijack + IFT Protocol Anomaly (locked: unlock with TL Creds)
- RESURGE Post-Exploitation — Coreboot Bootkit + Manifest Re-Signing + Upgrade Persistence (locked: unlock with TL Creds)
- RESURGE C2/Lateral — Credential Harvesting + SSH Lateral Movement + Passive Exfiltration (locked: unlock with TL Creds)
- RESURGE Exploitation — LD_PRELOAD Hijacking + Implant Library Deployment on Linux Appliance (locked: unlock with TL Creds)
- RESURGE Post-Exploitation — SPAWNSLOTH Funchook Log Interception + Integrity Scanner Tampering (locked: unlock with TL Creds)
- RESURGE C2/Lateral — TLS Traffic Signaling + P-521 ECC Anomaly + Passive C2 Architecture Indicators (locked: unlock with TL Creds)
- RESURGE Exploitation — CVE-2025-0282 IFT Buffer Overflow + Implant Deployment on Ivanti Appliance (locked: unlock with TL Creds)
- RESURGE Post-Exploitation — Web Shell + SPAWNSLOTH Log Tampering + Integrity Check Bypass (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 20)

Defanged, TLP:CLEAR.

- File hash: `52bbc44eb451cb5e16bf98bc5b1823d2f47a18d71f14543b460395a1c1b1aeda`
- File hash: `3526af9189533470bc0e90d54bafb0db7bda784be82a372ce112e361f7c7b104`
- File hash: `b1221000f43734436ec8022caaa34b133f4581ca3ae8eccd8d57ea62573f301d`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [CISA MAR-25993211-r1.v2 — RESURGE Malware Analysis Report (Updated Feb 2026)](https://www.cisa.gov/news-events/analysis-reports/ar25-087a)
- [CISA Mitigation Instructions for CVE-2025-0282](https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282)
- [Picus Security — RESURGE Malware Exploits Ivanti Connect Secure CVE-2025-0282](https://www.picussecurity.com/resource/resurge-malware-exploits-ivanti-connect-secure-cve-2025-0282-vulnerability)
- [Ivanti Security Advisory — CVE-2025-0282, CVE-2025-0283](https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283)
- [Palo Alto Unit 42 — Threat Brief CVE-2025-0282 and CVE-2025-0283](https://unit42.paloaltonetworks.com/threat-brief-ivanti-cve-2025-0282-cve-2025-0283/)
- [Mandiant — Ivanti Connect Secure VPN Zero-Day Exploitation](https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day)
- [Watchtowr Labs — CVE-2025-0282 Exploitation Walkthrough and PoC](https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/)
- [CISA KEV — CVE-2025-0282 Added to Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [NVD — CVE-2025-0282 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-0282)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0163