CyberzSOC

(Updated April 8, 2025) CISA updated these mitigations based on identification of a new malware variant called RESURGE that could undermine the effectiveness of the mitigations previously provided. For more information on RESURGE, see MAR-25993211.R1.V1.CLEAR and CISA Releases Malware Analysis Report on RESURGE Malware Associated with Ivanti Connect Secure . A cyber threat actor could exploit CVE-2025-0282 to take control of an affected system. CISA has added CVE-2025-0282 to its Known Exploited Vulnerabilities Catalog , based on evidence of active exploitation. Mandiant: Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation Palo Alto Networks: Threat Brief: CVE-2025-0282 and CVE-2025-0283 (Updated Jan. 17) For all instances of Ivanti Connect Secure, Policy Secure, and ZTA Gateways, see the following steps for general hunting guidance: Conduct threat hunting actions: Run an external Integrity Checker Tool (ICT). Conduct threat hunt actions on any systems connected to—or recently connected to—the affected Ivanti device.