In April 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the UK’s National Cyber Security Centre (NCSC) released a joint advisory on a newly identified backdoor named “FIRESTARTER,” deployed by the state-linked APT group UAT-4356 targeting Cisco Firepower devices. This malware was initially discovered in September 2025 on Cisco Firepower appliances within a U.S. federal civilian agency, and remained in use as a re-entry mechanism for attackers until as recently as March 2026, nearly six months later.
The attack chain begins with exploitation of known vulnerabilities (CVE-2025-20333, CVE-2025-20362) to gain initial access, followed by the deployment of LINE VIPER and FIRESTARTER to take control of the network device itself. Notably, because the target is a network perimeter device, this attack represents a higher level of risk compared to typical endpoint compromises.
This article analyzes the technical architecture and intrusion flow of FIRESTARTER, and examines how externally exposed Cisco ASA assets can form a critical attack surface within this campaign.
FIRESTARTER Overview
| Category | Description |
|---|---|
| Malicious Code Name | FIRESTARTER |
| Affected Target | Cisco Firepower & Secure Firewall devices running Cisco ASA Software or Firepower Threat Defense (FTD) |
| Attack Type | Backdoor |
| Related Vulnerability | CVE-2025-20333 (CVSS 9.9), CVE-2025-20362 (CVSS 6.5) |
| Key Characteristics | 1. Persistence maintained post-firmware update 2. Automatic re-execution after reboot 3. Executes commands via hooking within the LINA process |
| Related Toolkit | LINE VIPER (post-exploitation) |
FIRESTARTER is a custom backdoor deployed by the state-sponsored APT group UAT-4356 (Storm-1849). Cisco Talos previously attributed this group to the ArcaneDoor campaign in 2024, where they exploited two Cisco ASA zero-day vulnerabilities (CVE-2024-20353, CVE-2024-20359) to deploy malware such as Line Dancer and Line Runner. FIRESTARTER represents an evolution of these tactics, leveraging n-day vulnerabilities (CVE-2025-20333, CVE-2025-20362) that were patched in September 2025. It also shows significant technical similarities to the previously disclosed RayInitiator bootkit.
Attack Flow Analysis
Phase 1 – Initial Compromise
UAT-4356 chains two vulnerabilities to gain initial access. CVE-2025-20362 (CVSS 6.5) is an unauthenticated URL access vulnerability in the VPN web server component of Cisco ASA/FTD. Attackers can access restricted URL paths without authentication, enabling session validation bypass, credential harvesting, or reconnaissance. CVE-2025-20333 (CVSS 9.9) affects the same WebVPN component and allows an authenticated remote attacker with valid VPN credentials to execute arbitrary code with root privileges. When combined, these vulnerabilities effectively enable unauthenticated remote code execution.
Once initial access is achieved, attackers deploy the post-exploitation toolkit LINE VIPER.
Phase 2 – FIRESTARTER Deployment and Persistence
Using access provided by LINE VIPER, attackers implant FIRESTARTER onto the Firepower device. FIRESTARTER is a Linux ELF binary that inserts hooks into the LINA (Linux-based Integrated Network Architecture) process, the core network processing engine. The hook replaces a legitimate WebVPN XML handler function with the address of a malicious Stage 2 shellcode. When an attacker sends a specially crafted WebVPN authentication request containing a specific “magic packet” pattern, arbitrary shellcode is executed within the LINA process.
Persistence is achieved by manipulating the CSP_MOUNT_LIST of the Cisco Service Platform (CSP). Upon receiving a reboot signal, FIRESTARTER copies itself to a backup path (/opt/cisco/platform/logs/var/log/svc_samcore.log) and modifies the mount list to ensure it is re-executed from /usr/bin/lina_cs after reboot. After the reboot, it restores the original mount list and removes related files from disk to erase traces. This mechanism survives soft reboots and firmware updates and can only be removed via a hard power cycle. Cisco explicitly stated that commands such as shutdown, reboot, or reload do not remove the implant, and that physically disconnecting power is required.
Phase 3 – Six-Month Persistence and Re-Entry After Patching
A key aspect of this incident is that attackers successfully re-accessed systems even after patches were applied. According to a CISA-reported federal breach case, initial compromise occurred in early September 2025, and FIRESTARTER was installed before September 25. Despite subsequent patching, attackers maintained access through FIRESTARTER and re-deployed LINE VIPER as late as March 2026. This indicates a six-month dwell time, during which attackers remained undetected.
Phase 4 – Covert SOHO Network Used by China-Linked APTs
This advisory was released alongside a joint report from five countries, warning that China-linked APT groups such as Volt Typhoon and Flax Typhoon are building covert networks by compromising consumer-grade IoT devices (e.g., SOHO routers, IP cameras, DVRs). These devices are used as relay nodes for attack traffic, and in some cases are shared across multiple APT groups, rendering traditional IP-based blocking ineffective.
UAT-4356, attributed to the FIRESTARTER campaign, is believed to be part of this broader ecosystem. The group has consistently demonstrated similar tactics across campaigns such as ArcaneDoor (2024), Silver Dragon (2026), and Operation TrueChaos, leveraging legitimate infrastructure and trusted channels to conceal malicious activity.
Internet-Exposed Cisco ASA Assets Observed via Criminal IP
To evaluate the real-world attack surface of the FIRESTARTER campaign, internet-exposed Cisco ASA assets were identified and analyzed using Criminal IP Asset Search.
Criminal IP Search Query: product: “cisco asa firewall http config”
Cisco ASA devices expose unique product identifiers within their HTTP configuration interfaces, making it possible to effectively detect externally exposed management interfaces using simple product name–based searches. This query identifies all Cisco ASA devices whose management interfaces are accessible from the internet, regardless of whether SSL VPN functionality is enabled. It can be used to identify potential victim assets of the FIRESTARTER backdoor campaign and simultaneously verify targets relevant to the chaining attack described in the CISA–NCSC joint advisory.
As of April 2026, approximately 2,250 exposed assets were identified using this query. These are not merely open systems, they are network security appliances with management interfaces directly exposed to the internet. In scenarios where authentication bypass and remote code execution vectors are chained, such assets can become high-risk targets that are immediately exploitable without additional conditions.
Criminal IP Search Query: product: “cisco asa firewall http config” tag: “SSL VPN”
When filtering the overall Cisco ASA exposure dataset to include only devices that actively expose SSL VPN services externally, the most directly relevant high-risk asset group for this campaign emerges. Since the FIRESTARTER backdoor executes arbitrary shellcode by parsing specially crafted “magic packets” within WebVPN authentication requests, devices exposing SSL VPN to the internet represent the most direct attack surface.
Using this refined query, 57 devices were identified as exposing SSL VPN services directly to the internet as of April 2026. These assets closely match the attack profile described in the CISA–NCSC advisory, with both management interfaces and VPN functionality accessible externally, providing attackers with a direct entry point for deploying the FIRESTARTER backdoor.
A detailed analysis of individual assets in Criminal IP shows many cases where HTTPS (443) and management interface ports are open simultaneously. This indicates that both VPN functionality and management interfaces are exposed to the internet, providing attackers with multiple entry points to deploy the FIRESTARTER implant or the LINE VIPER post-exploitation toolkit.
In environments where FIRESTARTER is deployed, the threat goes beyond initial access. The backdoor survives firmware updates and reboots, registering itself in the boot sequence to automatically reactivate on every system restart. Meanwhile, the LINE VIPER toolkit enables packet capture, VPN authentication bypass, syslog suppression, and credential harvesting, allowing attackers to maintain persistent and stealthy access even after detection and patching.
Mitigation and Recommendations
Although CVE-2025-20333 and CVE-2025-20362 were patched in September 2025, as observed, patching alone does not remove the FIRESTARTER backdoor from already compromised devices. FIRESTARTER manipulates the CSP_MOUNT_LIST to persist across reboots and cannot be removed through standard soft reboot commands (reboot, reload) or firmware updates.
Cisco recommends either a hard power cycle (physical power disconnection) or full device reimaging to remove the malware. Therefore, the response must assume that compromise may have already occurred, rather than relying solely on patching.
Organizations should prioritize the following actions:
- Update Cisco ASA / FTD devices to the latest patched versions
- Perform full reimaging on suspected compromised devices
- Conduct a hard power cycle to ensure complete removal
- Block external exposure of management interfaces (HTTP/HTTPS)
- Enforce access control and IP restrictions on SSL VPN (WebVPN)
For externally exposed devices, access control must be prioritized regardless of patch status, as they remain immediate targets.
If compromise is suspected, the following elements should be considered untrusted:
- VPN user accounts and authentication credentials
- Entire device configuration
- Authentication and session-related keys
- Network traffic and log data
This is because the combination of FIRESTARTER and LINE VIPER enables packet capture, authentication bypass, log suppression, and credential theft.
FAQ
Q1. Do we still need to check for FIRESTARTER after applying patches?
Yes. This is the core issue of the incident. While patches fix the vulnerabilities themselves, they do not remove FIRESTARTER if it was already installed prior to patching. In the federal agency case, attackers maintained access for nearly six months after patching via the backdoor. Verification through CLI commands or core dump analysis is essential regardless of patch status.
Q2. What should organizations using Cisco ASA for firewall/VPN prioritize?
The first step is to identify all externally accessible Cisco ASA devices. Devices exposing VPN web interfaces (WebVPN/SSL VPN) are direct targets in this campaign and should have external access restricted or blocked immediately.
Next steps include:
- Checking for compromise using commands such as
show kernel process | include lina_cs - Performing hard power cycles and reimaging if compromise is confirmed
- Rotating all configurations and credentials, treating them as compromised
Conclusion
The FIRESTARTER incident demands a fundamental reassessment of network edge security. Firewalls and VPN appliances are among the most trusted components in an organization, yet they are also high-value targets for attackers. In this case, attackers remained undetected for six months after patching, turning the firewall itself into a tool for traffic interception and credential theft. As emphasized by CISA, patching is a necessary but not sufficient condition for security.
Effective defense begins with identifying which assets are externally exposed and verifying whether they have already been compromised. Protecting the network edge is no longer just about firewall rules—it requires continuous visibility into who can access the edge and whether an attacker is already inside.
In relation to this you can refer to nginx-ui MCPwn (CVE-2026-33032) Analysis: Nginx Server Compromise via Missing MCP Authentication
You can subscribe to Criminal IP (criminalip.io/register) and start detecting vulnerable assets right away. You can also request a demo using the button below and explore Criminal IP’s threat intelligence (TI) analysis of externally exposed assets at the enterprise level.
This report is based on data from Criminal IP, a Cyber Threat Intelligence search engine. Sign up for a free Criminal IP account today to explore the search results mentioned in the report and delve into comprehensive threat intelligence.
Source: Criminal IP(https://www.criminalip.io), SECURITYWEEK (https://www.securityweek.com/us-federal-agencys-cisco-firewall-infected-with-firestarter-backdoor/), digwatch (https://dig.watch/updates/cisa-firestarter-malware-cisco-directive), TheHackerNews (https://thehackernews.com/2026/04/firestarter-backdoor-hit-federal-cisco.html)
Related article: https://www.criminalip.io/knowledge-hub/blog/34411