Firestarter Backdoor Persisted on Cisco Firewalls Despite Patches, Agencies Warn
Summary
U.S. and U.K. agencies identified Firestarter, a backdoor that can persist on Cisco firewalls after patches and standard reboots. CISA found it on a federal device and ordered agencies to audit appliances and submit memory snapshots.
Key points
- CISA said it found Firestarter on a U.S. federal agency’s Cisco Firepower device; U.S. and U.K. authorities published a malware analysis report.
- Cisco Talos attributed Firestarter to UAT-4356 and linked the actor to the earlier ArcaneDoor campaign.
- Firestarter manipulates the Service Platform mount list to restore itself after reboots and injects shellcode into LINA to intercept VPN authentication requests containing a trigger sequence.
- UAT-4356 exploited CVE-2025-20333 and CVE-2025-20362 for initial access; patching those vulnerabilities did not remove implants already on affected devices.
- In the analyzed federal incident, attackers used Line Viper to access configurations, credentials and encryption keys, then later used Firestarter to redeploy Line Viper.
- CISA ordered federal civilian agencies to audit Cisco firewall infrastructure and submit memory snapshots. Cisco recommends reimaging suspected devices and has released updated software.
Article Details
- Attack Vectors
- UAT-4356 exploited CVE-2025-20333, a remote code execution flaw in the VPN web server component, and CVE-2025-20362, an unauthorized access vulnerability, to gain initial access to Cisco devices.
- The attackers deployed Line Viper to access device configurations, credentials, and encryption keys, then installed Firestarter.
- Firestarter injects shellcode into LINA, intercepts VPN authentication requests, and executes attacker-supplied code when a request contains a hidden trigger sequence.
- Firestarter rewrites the Cisco Service Platform mount list and copies itself to a secondary location so it can relaunch after software updates and standard reboots.
- Defensive Notes
- Cisco released updated software to address the persistence mechanism, but recommends reimaging devices when compromise is suspected.
- According to CISA and Cisco, a hard reboot—physically disconnecting the device from power—is required to clear the persistence mechanism from memory; a standard software reboot is insufficient.
- CISA's emergency directive required federal civilian agencies to audit Cisco firewall infrastructure and submit device memory snapshots for analysis.
- Cisco advises customers needing assistance to contact Cisco Technical Assistance.
MITRE ATT&CK
T1055 · Process InjectionFirestarter injects shellcode into LINA, Cisco's core networking and firewalling code.T1190 · Exploit Public-Facing ApplicationUAT-4356 exploited vulnerabilities in the VPN web server component and device access controls for initial entry.T1205 · Traffic SignalingFirestarter waits for a hidden trigger sequence in a VPN authentication request before executing attacker-supplied code.T1547 · Boot or Logon Autostart ExecutionFirestarter rewrites the Service Platform mount list so it is restored and relaunched during device boot.
CVE
CVE-2025-20333Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software; Cisco · Cisco Secure Firewall Threat Defense (FTD) SoftwareAttackers exploited CVE-2025-20333 and CVE-2025-20362 for initial access and used a separate implant, Line Viper, to harvest credentials and keys.CVE-2025-20362Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software; Cisco · Cisco Secure Firewall Threat Defense (FTD) SoftwareAttackers exploited CVE-2025-20333 and CVE-2025-20362 for initial access and used a separate implant, Line Viper, to harvest credentials and keys.
Threat Actors
Malware
FIRESTARTERauthorities disclosed that a state-sponsored group implanted a custom backdoor called Firestarter on Cisco network security devices that can survive firmware updates and standard reboots, enabling long-term persistence.Line ViperAttackers exploited CVE-2025-20333 and CVE-2025-20362 for initial access and used a separate implant, Line Viper, to harvest credentials and keys.RayInitiatorthat Firestarter shares significant technical similarities with a previously documented implant called RayInitiator, suggesting the tools share a common origin or development history within UAT-4356’s arsenal.
Vendors
Products
Adaptive Security ApplianceFrom there, the malware injects malicious shellcode into LINA, the core networking and firewalling code of Cisco’s Adaptive Security Appliance and Firepower Threat Defense software.Cisco FirepowerNCSC identified the persistent backdoor, code-named Firestarter, on Cisco Firepower and Secure Firewall devices.Cisco Secure FirewallNCSC identified the persistent backdoor, code-named Firestarter, on Cisco Firepower and Secure Firewall devices.Firepower Threat DefenseFrom there, the malware injects malicious shellcode into LINA, the core networking and firewalling code of Cisco’s Adaptive Security Appliance and Firepower Threat Defense software.
Countries
Chinabut Censys researchers previously said it found compelling evidence indicating a threat group based in China was behind the ArcaneDoor campaign.United KingdomThe Cybersecurity and Infrastructure Security Agency and the United Kingdom’s National Cyber Security Centre jointly published a malware analysis report identifying the backdoor, code-named Firestarter.United StatesU.S. and U.K.
Industries
Critical infrastructureand British cybersecurity authorities disclosed Thursday, marking a significant escalation in a campaign that has targeted government and critical infrastructure networks since at least late 2025.Governmentand British cybersecurity authorities disclosed Thursday, marking a significant escalation in a campaign that has targeted government and critical infrastructure networks since at least late 2025.