The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released updated technical details on RESURGE, a stealthy malicious implant deployed in zero-day attacks exploiting CVE-2025-0282 in Ivanti Connect Secure devices, which Mandiant attributes to a China-linked threat actor tracked as UNC5221 since mid-December 2024. The primary component, a 32-bit Linux shared object file (libdsupgrade.so), functions as a passive command-and-control (C2) implant with rootkit, bootkit, backdoor, proxying, and tunneling capabilities, designed to evade detection by waiting indefinitely for specially crafted inbound TLS connections rather than beaconing outward. It hooks the web server’s accept() function to inspect TLS traffic using CRC32-based fingerprinting, forwarding legitimate traffic to the Ivanti server while intercepting attacker connections authenticated via a forged Ivanti certificate. Although the fake certificate is not used for encryption, it enables authentication and impersonation, and because it is transmitted unencrypted, it may serve as a detectable network signature. Once validated, attackers establish encrypted mutual TLS sessions using elliptic curve cryptography, with the implant verifying keys against a hard-coded EC certificate authority. Additional components include a SpawnSloth variant (liblogblock.so) for log tampering and a kernel extraction script (dsmain) enabling firmware decryption and modification for boot-level persistence. CTIX analysts warn that RESURGE can remain dormant and undetected until activated by a remote operator, posing an ongoing risk, and urges administrators to use updated indicators of compromise to identify and remediate infections.