Weekly Cybersecurity Recap: Fast16, FIRESTARTER, Bitwarden CLI Attack and More
Summary
This weekly roundup covers fast16’s potential simulation tampering, UNC6692’s Snow malware, FIRESTARTER on a U.S. agency’s Cisco ASA, Lotus Wiper, Bitwarden CLI supply-chain abuse, and other security developments.
Key points
- An investigation dates fast16, a Lua-based framework intended to subtly alter high-precision calculations, to 2005; whether it was deployed in the wild is unknown.
- UNC6692 reportedly used Teams help-desk impersonation to deploy the Snow malware suite for credential theft and domain takeover.
- CISA reported that an unnamed U.S. federal civilian agency’s Cisco ASA device was compromised by FIRESTARTER in September 2025; Cisco recommends reimaging and updating because the backdoor can survive patches and reboots.
- Lotus Wiper was reportedly used against energy and utility targets in Venezuela; its described capabilities include erasing recovery mechanisms and overwriting physical drives.
- The compromised @bitwarden/[email protected] package contained code to steal developer data and use stolen npm credentials to spread to other packages; Bitwarden says it addressed the issue.
- Google reported a 32% relative increase in malicious indirect prompt-injection detections in its scans of CommonCrawl archives between November 2025 and February 2026.
- Huntress reported a rise in incidents involving compromised Bomgar instances after the disclosure of CVE-2026-1731; the specific root cause of the incidents was unclear.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering malware, threat activity, software supply-chain compromise, and exploitation of remote-access infrastructure.
- Impact
- Reported incidents included credential theft and potential domain takeover through UNC6692’s Snow malware suite; compromise of a U.S. federal agency’s Cisco device by FIRESTARTER; destructive wiping of Venezuelan energy and utilities systems; and theft of developer data with malicious code propagation through npm packages in the Bitwarden CLI supply-chain attack. The article also reports attacks involving compromised Bomgar instances and attackers using Datto CentraStage to access victims’ internal networks.
MITRE ATT&CK
T1071.001 · Web ProtocolsIn the Snow malware suite, attacker commands and results were relayed through a pipeline using HTTP POST requests.T1195.002 · Compromise Software Supply ChainThe Bitwarden CLI supply-chain campaign involved a compromised package and malicious code that used stolen npm credentials to inject code into other packages.T1656 · ImpersonationUNC6692 reportedly used Teams help-desk impersonation as part of its social-engineering activity.
CVE
CVE-2025-20333Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software; Cisco · Cisco Secure Firewall Threat Defense (FTD) Softwareto Cisco Adaptive Security Appliance (ASA) firmware by exploiting now-patched security flaws such as CVE-2025-20333 and CVE-2025-20362.CVE-2025-20362Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software; Cisco · Cisco Secure Firewall Threat Defense (FTD) SoftwareSecurity Appliance (ASA) firmware by exploiting now-patched security flaws such as CVE-2025-20333 and CVE-2025-20362.CVE-2026-1731BeyondTrust · Remote Support(RS) & Privileged Remote Access(PRA)“The surge follows intermittent waves of exploitation we have seen over the past two months, after BeyondTrust first disclosed a critical-severity flaw (CVE-2026-1731) in Bomgar in February,” the company said.
People
Threat Actors
RhantusName used in the article for threat actors linked to the Trigona ransomware; they were reported to use a custom data-exfiltration tool in attacks detected in March 2026.TeamPCPReported as the apparent actor behind the Bitwarden CLI supply-chain attack, although references to “Shai-Hulud: The Third Coming” complicated attribution.The GentlemenRansomware-as-a-service operation whose associated threat actors were observed attempting to deploy SystemBC.UNC6692Tracked threat group reported to use Teams help-desk impersonation to deploy the Snow malware suite for credential theft and domain takeover.
Malware
fast16Old and new attack techniques are back in full force: a Lua-based framework called fast16 predates Stuxnet and aims to subtly tamper with highâprecision simulation software, while attackers continue to exploit browserFIRESTARTERThis week also saw UNC6692’s Teams helpâdesk impersonation, the FIRESTARTER backdoor compromising Cisco ASA devices, Bitwarden CLI supplyâchain abuse, and destructive wipers like Lotus Wiper hitting criticalLotus Wipercompromising Cisco ASA devices, Bitwarden CLI supplyâchain abuse, and destructive wipers like Lotus Wiper hitting critical infrastructure.SnowUNC6692 used Teams helpâdesk impersonation to deploy the Snow malware suite for credential theft and domain takeover.SystemBCThe Gentlemen Deploys SystemBC Malware—Threat actors associated with The Gentlemen ransomwareâasâaâservice (RaaS) operation have been observed attempting to deploy a known proxy malware called SystemBC.
Vendors
BeyondTrust“The surge follows intermittent waves of exploitation we have seen over the past two months, after BeyondTrust first disclosed a critical-severity flaw (CVE-2026-1731) in Bomgar in February,” the company said.Bitwardensaw UNC6692’s Teams helpâdesk impersonation, the FIRESTARTER backdoor compromising Cisco ASA devices, Bitwarden CLI supplyâchain abuse, and destructive wipers like Lotus Wiper hitting critical infrastructure.CiscoThis week also saw UNC6692’s Teams helpâdesk impersonation, the FIRESTARTER backdoor compromising Cisco ASA devices, Bitwarden CLI supplyâchain abuse, and destructive wipers like Lotus Wiper hitting criticalDattoFortra has also spotted phishing campaigns trying to lure victims into installing Datto’sâ¯CentraStage remote monitoring and management tool, which attackers are then using to connect back into the victim’s internal
Products
Adaptive Security Appliance(CISA) revealed that an unnamed federal civilian agency’s Cisco Firepower device running Adaptive Security Appliance (ASA) software was compromised in September 2025 with a new malware called FIRESTARTER.BeyondTrust Remote Support“On February 6, 2026, BeyondTrust issued fixes for the flaw in Bomgar (rebranded as BeyondTrust Remote Support), which could be exploited by an unauthenticated attacker to remotely execute code.” The specific root causeBitwarden CLIUNC6692’s Teams helpâdesk impersonation, the FIRESTARTER backdoor compromising Cisco ASA devices, Bitwarden CLI supplyâchain abuse, and destructive wipers like Lotus Wiper hitting critical infrastructure.BomgarSurge in Attacks Involving Compromised Bomgar Instances —Huntress has recorded an uptick in incidents involving compromised Bomgar remote monitoring and management (RMM) instances.Cisco Firepowerand Infrastructure Security Agency (CISA) revealed that an unnamed federal civilian agency’s Cisco Firepower device running Adaptive Security Appliance (ASA) software was compromised in September 2025 with aGoogle AuthenticatorMalicious Chrome Extension Masquerades as Google Authenticator —A malicious Chrome extension posing as the official Google Authenticator app was identified in the official extension marketplace as part of an ongoing
Countries
RussiaOver 1.2K C2 Servers Linked to Russian Infrastructure Providers —A large-scale study of the Russian web hosting space has found more than 1,250 malicious command-and-control servers hosted inside Russia this year.United StatesWidely regarded as a joint U.S.-Israeli project, Stuxnet marked a turning point in cyber warfare as the first disruptive digital weapon and eventually served as the blueprint for the Duqu information-stealing rootkit.Venezueladata wiper codenamed Lotus Wiper has been used in attacks targeting the energy and utilities sector in Venezuela at the end of last year and the start of 2026.