Malware
Line Viper
- First Reported
- Apr 23, 2026
- Latest Reported
- Apr 24, 2026
Reported Context (3)
- Attributed to actor UAT-4356 and often preceded by Line Viper deployment, the implant exploits CVE-2025-20333 and/or CVE-2025-20362, hooks into the LINA process to inject shellcode via crafted WebVPN requests, and can Firestarter Malware Persists on Cisco Firewalls Despite Patches and Reboots
- Attackers exploited CVE-2025-20333 and CVE-2025-20362 for initial access and used a separate implant, Line Viper, to harvest credentials and keys. Firestarter Backdoor Persisted on Cisco Firewalls Despite Patches, Agencies Warn
- infection, inventory devices, and follow remediation steps while warning that attackers also deployed Line Viper to bypass VPN authentication. CISA Reports U.S. Agency Breach Involving Cisco Devices and FIRESTARTER Backdoor
CVE (3)
Malware (2)
Threat Actors (1)
MITRE ATT&CK (4)
Vendors (1)
Products (6)
Industries (2)
Countries (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.