AISEC > Security News > Zero Day > RESURGE Malware Ivanti CVE-2025-0282 CISA Warning
February 27, 2026 #zero-day Source: BleepingComputer 2 min read · 553 words

CISA warns that RESURGE malware can be dormant on Ivanti devices

CISA попереджає, що малвер RESURGE може бути у сплячому стані на пристроях Ivanti

CISA Sounds the Alarm on Dormant Malware

The Cybersecurity and Infrastructure Security Agency just dropped something that should make every Ivanti customer sit up straight. RESURGE—a malicious implant that's been quietly exploiting CVE-2025-0282—can remain dormant on compromised Ivanti Connect Secure devices, according to CISA's latest disclosure reported by BleepingComputer. Dormant means it's sitting there. Waiting. That's the real nightmare scenario.

And here's the part that stings: you might not know it's there.

What We Know

CVE-2025-0282 is a zero-day vulnerability affecting Ivanti Connect Secure appliances. The flaw allows unauthenticated attackers to inject arbitrary code—meaning they can plant RESURGE without needing valid credentials. CISA's cyber attack statistics show that zero-day exploits targeting remote access solutions remain among the highest-value targets for state-sponsored and criminal actors alike.

RESURGE isn't your typical malware that screams its presence with ransomware notifications or data exfiltration alerts. It's a backdoor implant designed for persistence and stealth.

BleepingComputer's reporting indicates that affected organizations may have been compromised months ago without detection. The dormancy feature—that's the technical term for the malware going silent and waiting for activation commands—is particularly nasty because it extends the dwell time attackers have inside your network.

How It Works

The attack chain is straightforward in the worst way possible. An attacker exploits CVE-2025-0282 to gain code execution on an Ivanti Connect Secure device. From there, they plant the RESURGE implant. The malware then enters dormancy mode, essentially becoming invisible to most detection mechanisms. It's not making outbound connections, it's not consuming resources, it's not triggering behavioral alerts.

Only when activated—potentially weeks or months later—does it become a live threat.

This architecture reveals sophisticated threat actor thinking. Why risk immediate detection when you can establish a foothold, let defensive teams relax, and then activate when you're ready to move laterally through the network? It's a chess move, not a smash-and-grab.

Why It Matters

Ivanti Connect Secure is deployed in thousands of enterprises worldwide. If you're managing remote access infrastructure, there's a decent chance you've got one of these appliances sitting at your perimeter. So why does this matter? Because the assumption that your appliances are clean post-patching might be wrong.

CISA cyber security evaluation tools like CSET can help identify exposure, but they won't reveal an already-implanted backdoor if you're not looking at the right forensic indicators. The real question is whether your organization has actually conducted post-exploitation forensics on affected devices, or just applied the patch and moved on.

Frankly, this was avoidable had Ivanti's development practices caught this before it went public. But here we are.

Next Steps

First: patch immediately if you haven't. Second: don't stop there. You need to conduct forensic analysis on every Ivanti Connect Secure device in your environment to determine if RESURGE has been installed. That means memory dumps, file system analysis, and connection logs going back months.

Third: assume you might be compromised and act accordingly. Implement enhanced monitoring on your Ivanti devices specifically looking for RESURGE signatures and behavioral indicators that CISA will publish in updated advisories.

And consider this a forcing function to reassess your zero-trust architecture for remote access. Relying on a single perimeter appliance—even a patched one—isn't sufficient anymore. Layer additional authentication, segment your network aggressively, and reduce the blast radius if an appliance is compromised.

CISA's cyber security awareness and continued guidance on this vulnerability will evolve as more intelligence surfaces. Monitor their advisories closely and treat this with the urgency it deserves.

Read original article →

// FAQ

What is CVE-2025-0282 and which devices are affected?

CVE-2025-0282 is a zero-day vulnerability in Ivanti Connect Secure appliances that allows unauthenticated attackers to execute arbitrary code. All Ivanti Connect Secure devices without patches are vulnerable to exploitation and potential RESURGE implant installation.

Can RESURGE malware be detected after installation?

RESURGE is designed to remain dormant and avoid detection, making it difficult to identify without forensic analysis including memory dumps and file system examination. Standard endpoint detection tools may not catch dormant implants until they're activated by attackers.

What should organizations do if they have Ivanti Connect Secure devices?

Organizations must immediately patch CVE-2025-0282, conduct forensic analysis on affected devices to identify any RESURGE implants, implement enhanced monitoring, and review their remote access architecture to reduce reliance on single perimeter appliances.

// RELATED

#zero-day US Sanctions Russian Exploit Broker Operation Zero 2026-02-26 #zero-day Cisco SD-WAN Zero-Day Under Exploitation for 3 Years 2026-02-26

Concerned about your project's security? Run an automated pentest with AISEC — AI-powered scanner with expert verification. Go to dashboard →