RESURGE Covert Socket File Creation

Ethan Andrews@eandrews

•updated Feb 27, 2026•1•0•31

Detects the creation of the covert socket file '/home/runtime/tmp/.logsrv', which is used by the RESURGE malware as a communication bridge between its hooked 'web' process and its 'dsmdm' SSH component on Ivanti Connect Secure devices.