Firestarter Malware Persists on Cisco Firewalls Despite Patches and Reboots
Summary
U.S. and U.K. agencies report that UAT-4356-attributed Firestarter persists on Cisco ASA/FTD firewalls through reboots and updates, using LINA hooks and crafted WebVPN requests. They link access to CVE-2025-20333 and/or CVE-2025-20362 and advise reimaging.
Key points
- U.S. and U.K. cybersecurity agencies report Firestarter on Cisco Firepower and Secure Firewall devices running ASA or FTD.
- The backdoor is attributed to UAT-4356; CISA observed Line Viper deployed before Firestarter in one federal agency incident.
- Agencies assess that initial access involved CVE-2025-20333 and/or CVE-2025-20362; CISA said exploitation occurred before the agency applied patches.
- Firestarter persists across reboots, firmware updates, and security patches by hooking the LINA process and modifying CSP_MOUNT_LIST.
- A crafted WebVPN request can trigger shellcode execution; CISA did not provide details about the payloads observed.
- Cisco recommends reimaging and upgrading to fixed releases. Administrators can check for compromise with `show kernel process | include lina_cs`; CISA also published YARA rules.
- Cisco says a cold restart may remove the malware if reimaging is not possible, but warns of possible database or disk corruption.
Article Details
- Attack Vectors
- CISA and NCSC believe initial access was obtained by exploiting CVE-2025-20333, CVE-2025-20362, or both on affected Cisco firewall devices.
- In one reported incident, Line Viper was deployed first to establish VPN sessions and access configuration details, including administrative credentials, certificates, and private keys; Firestarter was then deployed for persistent access.
- Firestarter hooks into the LINA process and injects shellcode into memory. A specially crafted WebVPN request triggers execution of attacker-supplied payloads.
- Defensive Notes
- Cisco recommends reimaging affected devices and upgrading to fixed releases.
- Administrators can check for compromise with `show kernel process | include lina_cs`; Cisco says any resulting output should be treated as evidence of compromise.
- CISA published YARA rules for detecting Firestarter in a device disk image or core dump.
- Cisco says a cold restart may remove the malware if reimaging is not possible, but does not recommend it because of the risk of database or disk corruption and boot problems.
MITRE ATT&CK
T1055 · Process InjectionFirestarter hooks into the LINA process and injects shellcode into memory to create a controlled execution path.T1190 · Exploit Public-Facing ApplicationCISA and NCSC believe the actor gained initial access by exploiting vulnerabilities on Cisco firewall devices; the article also describes crafted WebVPN requests.
CVE
CVE-2025-20333Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software; Cisco · Cisco Secure Firewall Threat Defense (FTD) SoftwareAttributed to actor UAT-4356 and often preceded by Line Viper deployment, the implant exploits CVE-2025-20333 and/or CVE-2025-20362, hooks into the LINA process to inject shellcode via crafted WebVPN requests, and canCVE-2025-20362Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software; Cisco · Cisco Secure Firewall Threat Defense (FTD) SoftwareUAT-4356 and often preceded by Line Viper deployment, the implant exploits CVE-2025-20333 and/or CVE-2025-20362, hooks into the LINA process to inject shellcode via crafted WebVPN requests, and can be detected and
Threat Actors
Malware
FIRESTARTERcybersecurity agencies warn that a custom backdoor called Firestarter has been found persisting on Cisco Firepower and Secure Firewall devices running ASA or FTD, allowing attackers continued access even after patchesLine ViperAttributed to actor UAT-4356 and often preceded by Line Viper deployment, the implant exploits CVE-2025-20333 and/or CVE-2025-20362, hooks into the LINA process to inject shellcode via crafted WebVPN requests, and can
Vendors
Products
Adaptive Security Applianceare warning about a custom malware called Firestarter persisting on Cisco Firepower and Secure Firewall devices running Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD) software.Cisco Firepowercybersecurity agencies warn that a custom backdoor called Firestarter has been found persisting on Cisco Firepower and Secure Firewall devices running ASA or FTD, allowing attackers continued access even after patchesCisco Secure Firewallwarn that a custom backdoor called Firestarter has been found persisting on Cisco Firepower and Secure Firewall devices running ASA or FTD, allowing attackers continued access even after patches and reboots.Firepower Threat Defense (FTD)are warning about a custom malware called Firestarter persisting on Cisco Firepower and Secure Firewall devices running Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD) software.