Ivanti Malware Does It All

Hackers using Trojans connected to a malware family deployed by Chinese nation-state hackers are actively exploiting a now-patched vulnerability in Ivanti Connect Secure appliances.

See Also: How Government Agencies Build the Foundation for a New SOC to Gain the Upper Hand in National Security.

Internet appliance maker Ivanti pushed an emergency update to its VPN devices in January following evidence that suspected nation-state attackers exploited a critical stack-based buffer overflow vulnerability tracked as CVE-2025-0282 (see: Zero-Day Patch Alert: Ivanti Connect Secure Under Attack).

Analysis published Friday by the U.S. Cybersecurity and Infrastructure Security Agency warns that malicious files recovered from an attack on Ivanti’s appliance include a Trojan the agency dubs “Resurge.”

The malware “contains capabilities of a rootkit, dropper, backdoor, bootkit, proxy and tunneler,” CISA said. It creates a web shell copied into the Ivanti boot disk and modify files and manipulate integrity checks.

Its functionality appears to be an upgrade of Spawnchimera, a variant of the “Spawn” family of custom malware that cyberthreat intel firm Mandiant in 2024 spotted in attacks on Ivanti VPN appliances made by a suspected China-nexus espionage actor it tracks as UNC5325. The notion of it being an improvement on its predecessor is embedded in the Resurge file name “libdsupgrade.so.”

Another file recovered from the attack is a variant of Spawnsloth, a log tampering utility also seen in previous attacks against Ivanti devices by suspected Chinese actors. Attackers also loaded a custom embedded file that contained an open-source shell script “and a subset of applets from the open-source tool BusyBox,” CISA wrote. That allows hackers to perform functions such as downloading and executing payloads.

Microsoft in March attributed zero-day hacking using CVE-2025-0282 to the Chinese threat actor it tracks as Silk Typhoon. U.S. federal prosecutors in March indicted two Chinese hackers for Silk Typhoon activity including an 2024 intrusion into the Department of the Treasury server.

Chinese nation-state hackers have been particularly aggressive in making use of newly disclosed vulnerabilities in a bid to exploit them before system administrators deploy a patch. “They do so with a high operational tempo, sometimes abusing vulnerabilities on the day they are published,” the Dutch National Cyber Security Center said in February 2024 (see: Chinese Hackers Penetrated Unclassified Dutch Network).

Similarities between Resurge and Spawnchimera include how both malicious files create a secure shell tunnel for command and control. Spawnchimera and Resurge alike can survive reboots and hook into strncpy, a function in the C programming language that copies characters from one string to another. Researchers from Watchtowr earlier this year found that Ivanti developers did not limit the copying function to the size of the destination buffer. That allowed hackers to send large, malicious strings and ultimately achieve remote code execution. Both Trojans modify strncpy to correct size limit of 256 bytes, effectively fixing the flaw.