The Cybersecurity and Infrastructure Security Agency has issued a formal warning regarding a newly identified malware strain known as RESURGE that is actively targeting Ivanti Connect Secure devices. The alert highlights the exploitation of a critical zero day vulnerability tracked as CVE 2025 0282, which affects widely deployed remote access products.
According to CISA, the vulnerability was added to the Known Exploited Vulnerabilities Catalog on January 8, 2025, after evidence of active exploitation was first observed in December 2024. The flaw impacts Ivanti Connect Secure as well as related products including Policy Secure and ZTA Gateways. These systems are commonly used by enterprises and government agencies to provide secure remote connectivity for employees and partners.
CVE 2025 0282 is described as a stack based buffer overflow vulnerability. In such attacks, a threat actor sends more data to a memory buffer than it can handle. This overflow can corrupt adjacent memory locations and potentially allow the attacker to execute arbitrary code on the affected device. Successful exploitation may enable unauthorized access, system control and deployment of additional malicious payloads.
The RESURGE malware is specifically engineered to maintain persistence on compromised systems. Security researchers note that it can survive device reboots, making detection and remediation more challenging. In addition to persistence mechanisms, the malware is capable of harvesting credentials and extracting sensitive information from affected environments. This raises concerns about potential lateral movement within enterprise networks following an initial breach.
CISA has advised organizations using Ivanti Connect Secure and related appliances to immediately review vendor guidance, apply security patches and conduct thorough compromise assessments. Network administrators are encouraged to monitor logs for unusual activity and consider isolating affected devices until they can be verified as secure.
The exploitation of remote access infrastructure remains a high priority for cyber threat actors due to the privileged position these systems hold within organizational networks. A successful compromise can grant attackers a foothold that bypasses perimeter defenses. Given the widespread deployment of Ivanti solutions across both public and private sectors, the impact of such vulnerabilities can be significant.
Cybersecurity experts emphasize the importance of proactive patch management and continuous monitoring to mitigate risks associated with zero day vulnerabilities. The addition of CVE 2025 0282 to the Known Exploited Vulnerabilities Catalog indicates that federal agencies in the United States are required to address the issue within specified remediation timelines.
As cyber threats continue to evolve, security agencies worldwide are urging organizations to strengthen defenses around critical infrastructure components. The RESURGE malware campaign underscores the ongoing need for vigilance, timely updates and layered security strategies to protect sensitive systems and data.
