RESURGE Integrity Check Bypass

Ethan Andrews@eandrews

•updated Feb 27, 2026•1•0•49

Detects the modification of the 'check_integrity.sh' script to replace 'exit 1' with 'exit 0'. This is a specific defense evasion technique used by the RESURGE malware on Ivanti Connect Secure devices to ensure the compromised system always appears healthy during integrity scans.