Ivanti Connect Secure (ICS) RESURGE Malware Hash Detection

Daniel Jeremiah@daniyyell

•updated Feb 28, 2026•0•18

This rule detects the presence of specific file hashes associated with the RESURGE malware, which targets Ivanti Connect Secure devices, as published by CISA in AR25-087A. A match indicates a high probability of compromise on an Ivanti Connect Secure appliance.