MAR-25993211-r1.v1 Ivanti Connect Secure (RESURGE)

On March 28, 2025, the Cybersecurity and Infrastructure Security Agency issued an update regarding MAR-25993211-r1.v1 Ivanti Connect Secure (RESURGE). CISA analyzed files obtained from a compromised Ivanti device after threat actors exploited CVE-2025-0282 for initial access. The analysis revealed a malicious file called RESURGE, containing functionality similar to SPAWNCHIMERA malware, and another variant of SPAWNSLOTH malware that tampers with Ivanti device logs.