Coordinated Reconnaissance and Exploitation Activity Targeting Edge VPN Appliances

CISA issued updated technical details on RESURGE, a stealthy implant used in zero-day intrusions of Ivanti Connect Secure appliances via CVE-2025-0282. The malware (a 32-bit Linux shared object, libdsupgrade.so) is designed for long-term persistence and covert access, with capabilities described as including rootkit/bootkit-style functionality, credential theft via webshells, account manipulation, privilege escalation, and tunneling/proxying. CISA highlighted that RESURGE can remain dormant and evade detection by acting as a passive C2: rather than beaconing out, it waits for specific inbound TLS connections and, when loaded under the web process, hooks accept() to inspect TLS packets and only activate on attacker-identified traffic (using a CRC32-based TLS fingerprinting approach); non-matching traffic is passed through to the legitimate service. Reporting cited Mandiant’s attribution of the early exploitation activity to a China-linked actor tracked as UNC5221, with zero-day exploitation reported since mid-December 2024.

Separately, GreyNoise reported a large-scale reconnaissance campaign against SonicWall SonicOS/SSL VPN infrastructure (84,142 scanning sessions over several days) focused primarily on enumerating whether SSL VPN is enabled by probing a single API endpoint—behavior consistent with pre-attack target mapping rather than immediate CVE exploitation. The activity came from thousands of IPs across multiple ASNs and included heavy use of commercial proxy infrastructure (rotating exits) in short, concentrated bursts, a pattern GreyNoise assessed as coordinated and operationally segmented. GreyNoise assessed this recon as a precursor to credential-based intrusion and ransomware operations frequently associated with edge VPN access (citing Akira and Fog as examples), and noted broad internet exposure and a meaningful population of devices running vulnerable or unsupported firmware—conditions that increase the likelihood that reconnaissance will translate into follow-on compromise attempts.