CISA Reports FIRESTARTER Backdoor on Federal Cisco Firepower Device
Summary
CISA says a federal agency’s Cisco Firepower/ASA device was compromised in September 2025 using patched flaws to install FIRESTARTER, which survives normal reboots and firmware updates. LINE VIPER enabled post-exploitation actions; Cisco recommends reimaging or a cold,
Key points
- CISA reported that an unnamed federal civilian agency’s Cisco Firepower device running ASA software was compromised in September 2025; the actors reportedly retained access afterward.
- The attackers used CVE-2025-20333 and CVE-2025-20362, which Cisco has since patched.
- FIRESTARTER is a Linux ELF backdoor that alters the startup mount list to persist through firmware updates and normal reboots; a hard power cycle is needed to remove it temporarily.
- The LINE VIPER toolkit can execute CLI commands, capture packets, bypass VPN AAA, suppress syslog, harvest user commands, and force a delayed reboot.
- Cisco recommends reimaging and upgrading compromised devices, treating their configurations as untrusted, and using a cold power cycle as an interim measure.
- The activity is tracked by Cisco as UAT4356, also called Storm-1849; the article says its exact origins are unknown.
Article Details
- Event Type
- Cyber intrusion involving a persistent backdoor on a federal agency's Cisco device
- Impact
- A federal civilian agency's Cisco Firepower device running ASA software was compromised in September 2025. FIRESTARTER can persist through firmware updates and normal reboots, enabling continued remote access and arbitrary shellcode execution; LINE VIPER provided post-exploitation capabilities including CLI command execution, packet captures, VPN AAA bypass, syslog suppression, and command harvesting. Cisco recommends reimaging compromised devices; a cold power cycle may remove the implant. The article reports that the origins of the activity are unknown.
CVE
CVE-2025-20333Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software; Cisco · Cisco Secure Firewall Threat Defense (FTD) SoftwareThe intrusion leveraged now-patched vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to deliver FIRESTARTER alongside a postâexploitation toolkit called LINE VIPER, enabling remote command execution, packetCVE-2025-20362Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software; Cisco · Cisco Secure Firewall Threat Defense (FTD) SoftwareThe intrusion leveraged now-patched vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to deliver FIRESTARTER alongside a postâexploitation toolkit called LINE VIPER, enabling remote command execution, packet
Threat Actors
Flax TyphoonThe article reports that this state-sponsored group has used compromised SOHO router and IoT botnets to target critical infrastructure and conduct cyber espionage.UAT4356Cisco tracks exploitation activity associated with CVE-2025-20333 and CVE-2025-20362 under this name and attributes the FIRESTARTER-related activity to it.Volt TyphoonThe article reports that this state-sponsored group has used compromised SOHO router and IoT botnets to target critical infrastructure and conduct cyber espionage.
Malware
FIRESTARTERFirepower device running ASA software was compromised in September 2025 by a Linux ELF backdoor named FIRESTARTER that can persist through firmware updates and normal reboots by altering the device boot sequence.RayInitiatorThe resilience aside, it also shares some level of overlap with a previously documented bootkit referred to as RayInitiator.
Vendors
Products
ASACISA reported that a federal civilian agency’s Cisco Firepower device running ASA software was compromised in September 2025 by a Linux ELF backdoor named FIRESTARTER that can persist through firmware updates and normalCisco FirepowerCISA reported that a federal civilian agency’s Cisco Firepower device running ASA software was compromised in September 2025 by a Linux ELF backdoor named FIRESTARTER that can persist through firmware updates and normalFirepower Threat Defense (FTD)“FIRESTARTER can persist as an active threat on Cisco devices running ASA or Firepower Threat Defense (FTD) software, maintaining post-patching persistence and enabling threat actors to re-access compromised devices
Tools
Countries
ChinaThe exact origins of the threat activity are not known, although an analysis from attack surface management platform Censys in May 2024 suggested links to China.United StatesThe disclosure comes as the U.S., the U.K., and various international partners released a joint advisory about large-scale networks of compromised SOHO routers and IoT devices commandeered by China-nexus threat actors
Industries
Critical infrastructureconsisting of home routers, security cameras, video recorders, and other IoT devices, to target critical infrastructure sectors and conduct cyber espionage in a “low-cost, low-risk, deniable way,” per the alert.Governmentattacks: the targeting of network perimeter devices belonging to residential, enterprise, and government networks with an aim to either turn them into a proxy node or intercept sensitive data and