CISA SPAWNCHIMERA RESURGE February 2026

SPAWNCHIMERA has extracted the device’s Linux kernel image (vmlinux).

SPAWNCHIMERA has modified the boot process files within `/tmp/coreboot_fs/bin/init` to establish persistence.

SPAWNCHIMERA has executed only in memory and hooked itself into existing processes on the victim device to include the web process.

SPAWNCHIMERA has searched for running processes to include web or dsmdm.

SPAWNCHIMERA has searched the contents of two Python files scanner.py and scanner_legacy.py by searching for specific lines and replacing them with values that reduce their ability to track mismatches or new files.

SPAWNCHIMERA has deleted generated files and folders from victim devices.

SPAWNCHIMERA has updated the timestamp using the `touch` command.

SPAWNCHIMERA has created web shells that facilitate actions on the victim host.

SPAWNCHIMERA has generated RSA keys against modified files to sign the manifest file, so they appear legitimate.

SPAWNCHIMERA has created SSH tunnels to facilitate C2 communications.

SPAWNCHIMERA has used delayed execution to pause for a defined interval before performing environment discovery, repeatedly checking for specific processes, such as the `dslogserver` process, prior to continuing execution.

SPAWNCHIMERA has modified the Ivanti Integrity Checker Tool to evade detection.

SPAWNCHIMERA has disabled logging and log forwarding on Ivanti devices targeting the `dslogserver` process.