CISA Reports U.S. Agency Breach Involving Cisco Devices and FIRESTARTER Backdoor
Summary
CISA validated a breach at an unnamed U.S. federal agency involving Cisco Firepower/ASA devices, finding FIRESTARTER persistence that enabled access in March 2026 and Line Viper VPN-authentication bypass. Updated checks and remediation are required.
Key points
- CISA found FIRESTARTER on a U.S. federal agency’s Cisco Firepower device after identifying suspicious connections and conducting a forensic engagement.
- FIRESTARTER allowed attackers to regain access in March 2026 without re-exploiting the original Cisco vulnerabilities. CISA said it was deployed before September 25, 2025, but the exact date is unknown.
- Attackers also used Line Viper to establish VPN sessions that bypassed authentication and access administrative credentials, certificates, and private keys.
- CISA warned that applying security updates alone may not remove FIRESTARTER or eliminate attackers’ access. Agencies should unplug a device only if CISA directs them to do so.
- CISA and the U.K. NCSC issued updated advisories. Federal agencies must check for infection, inventory Cisco Firepower devices, and report findings.
- CISA did not identify the country behind the activity. Wired cited sources describing it as apparently aligned with China’s state interests.
Article Details
- Victim Organization
- Unnamed U.S. federal civilian agency
- Victim Domain
- Unknown
- Incident Type
- Confirmed breach of a Cisco Firepower device involving exploitation of vulnerabilities, deployment of FIRESTARTER for persistence, and use of Line Viper to establish VPN sessions that bypassed authentication.
- Data Types Exposed
- Administrative credentials (accessible; theft is not confirmed)
- Certificates (accessible; theft is not confirmed)
- Private keys (accessible; theft is not confirmed)
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Attackers retained persistence on the compromised device and regained access in March 2026 without re-exploiting the original vulnerabilities. Line Viper established illegitimate VPN sessions that bypassed authentication policies. No operational disruption is reported.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
CVE
CVE-2025-20333Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software; Cisco · Cisco Secure Firewall Threat Defense (FTD) SoftwareDevices that were compromised before defenders patched CVE-2025-20333 and CVE-2025-20362 are still vulnerable because of FIRESTARTER.CVE-2025-20362Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software; Cisco · Cisco Secure Firewall Threat Defense (FTD) SoftwareFIRESTARTER provides persistence, enabling attackers to regain access without re-exploiting CVE-2025-30333 and CVE-2025-20362.CVE-2025-30333Vendor / Product unavailableFIRESTARTER provides persistence, enabling attackers to regain access without re-exploiting CVE-2025-30333 and CVE-2025-20362.
Malware
FIRESTARTERagency was breached via vulnerabilities in Cisco ASA/Firepower devices and infected with malware named FIRESTARTER, which allowed attackers to maintain persistence and later regain access without re-exploiting theLine Viperinfection, inventory devices, and follow remediation steps while warning that attackers also deployed Line Viper to bypass VPN authentication.
Vendors
Products
Cisco Adaptive Security Appliance (ASA)CISA first warned of the issues in September, when it ordered all agencies to patch CVE-2025-30333 and CVE-2025-20362 — two vulnerabilities impacting Cisco Adaptive Security Appliances (ASA).Cisco Firepowerfederal agency’s Cisco Firepower device after identifying suspicious connections.Cisco Secure Firewallthreat actors retaining persistence and continued unauthorized access to Cisco Firepower and Secure Firewall products with Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD) software.”Firepower Threat Defense (FTD)to Cisco Firepower and Secure Firewall products with Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD) software.”