CISA issues updated RESURGE malware analysis highlighting a stealthy but active threat

The Cybersecurity and Infrastructure Security Agency has released an updated Malware Analysis Report (MAR) revealing new findings on RESURGE, a highly sophisticated malware implant that exploits vulnerabilities to gain covert Secure Shell (SSH)–based command‑and‑control access.

The updated analysis provides network defenders with deeper technical insights and improved detection resources, while issuing a clear warning: RESURGE is engineered to persist silently on compromised systems, remaining dormant until a remote actor connects.

This stealth capability enables the malware to evade routine scans and monitoring — meaning RESURGE may still be present and undetected on Ivanti Connect Secure devices, posing an active and ongoing threat to affected networks. 

Return to Alerts