- CISA warns of new malware targeting vulnerable Ivanti products
- More products that are vulnerable to an error in 2024 are targeted
- Malware can create web shells, harvest information and more
Several Ivanti products are targeted by a piece of malware called Resurge, a new security advice published by US cyber security and infrastructure security agency (CISA), has said, detailed both malware and the vulnerability used to implement it.
Resurge is a variant of Spawnchimera, a piece of malware targeted at Ivanti, connects secure appliances, enabling unauthorized access and sustained control over vulnerable final points.
While resurgers can also survive restarts, malware can also create web shells, manipulate integrity control, change files and use web shells to harvest credentials, create accounts, reset passwords and escalate permissions.
Risk of Remote Code -Insiko
Furthermore, Resurge can copy the web -shell to the Ivanti Running Boot disk and manipulate the running CoreBot image.
To infect the devices with resurgus, threat actors abuse CVE-2025-0282, a critical stack-based puff overflow overflowing in Ivanti connects safe, political safe and neurons to ZTA-Gateways. It allows remote non-authentic attackers to perform arbitrary code and have been utilized in nature since mid-December 2024.
CISA added the threat to his KEV catalog at the beginning of January 2025, noting that the vulnerable software includes Ivanti Connect Secure (before version 22.7R2.5), Ivanti policy safe (before version 22.7R1.2) and Ivanti Neurons for ZTA Gateways (before version 22.7R2.3).
There are a number of things companies could do to mitigate the risk, says Cisa.
“For the highest level of self -confidence, you must complete the factory,” says the advisory. “For cloud and virtual systems, you need to complete a factory setting using an external clean image of the device.”
Furthermore, users must reset the credentials of privileged and non-privileged accounts, reset passwords for all domain users and all local accounts, review access policies to temporarily revoke privileges/access to affected devices, reset the relevant account agency information or access keys and monitor related accounts, especially administrative accounts.
Via Registered
