{"id":235285,"date":"2026-04-24T16:34:00","date_gmt":"2026-04-24T20:34:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/04\/24\/firestarter-malware-survives-cisco-firewall-updates-security-patches\/"},"modified":"2026-04-24T17:45:14","modified_gmt":"2026-04-24T21:45:14","slug":"firestarter-malware-survives-cisco-firewall-updates-security-patches","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/04\/24\/firestarter-malware-survives-cisco-firewall-updates-security-patches\/","title":{"rendered":"Firestarter malware survives Cisco firewall updates, security patches"},"content":{"rendered":"

Firestarter malware survives Cisco firewall updates, security patches<\/a><\/p>\n

https:\/\/www.bleepingcomputer.com\/news\/security\/firestarter-malware-survives-cisco-firewall-updates-security-patches\/amp\/<\/a><\/p>\n

Publish Date: 2026-04-24 16:34:00<\/a><\/p>\n

Source Domain: www.bleepingcomputer.com<\/a><\/p>\n

Cybersecurity agencies in the U.S. and U.K. are warning about a custom malware called Firestarter persisting on Cisco Firepower and Secure Firewall devices running Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD) software.<\/p>\n

The backdoor has been attributed to a threat actor that Cisco Talos tracks internally as UAT-4356, known for cyberespionage campaigns, including ArcaneDoor.<\/p>\n

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the U.K. National Cyber Security Center (NCSC) believe that the adversary obtained initial access by exploiting a missing authorization issue (CVE-2025-20333) and\/or a buffer overflow bug (CVE-2025-20362).<\/p>\n

In one incident at a federal civilian executive branch agency, CISA observed the threat actor first deploying the Line Viper malware, a user-mode shellcode loader, and then using Firestarter, which enables continued access even after patching.<\/p>\n

\u201cCISA has not confirmed the exact date of initial exploitation but assesses the compromise occurred in early September 2025, and before the agency implemented patches in accordance with ED 25-03,\u201d the agency notes in an alert.<\/p>\n

Line Viper is used to establish VPN sessions and access all configuration details, including administrative credentials, certificates, and private keys on compromised Firepower devices.<\/p>\n

Next, the ELF binary for the Firestarter backdoor is deployed for persistence, allowing the threat actor to regain access when needed.<\/p>\n

Once Firestarter nests on the devices, it maintains persistence across reboots, firmware updates, and security patches. Furthermore, the backdoor relaunches automatically if terminated.<\/p>\n

Persistence is achieved by hooking into LINA, the core Cisco ASA process, and using signal handlers that trigger reinstallation routines.<\/p>\n

A joint malware analysis report from the two cybersecurity agencies explains that Firestarter modifies the CSP_MOUNT_LIST boot\/mount file to ensure execution on startup,…<\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Firestarter malware survives Cisco firewall updates, security patches https:\/\/www.bleepingcomputer.com\/news\/security\/firestarter-malware-survives-cisco-firewall-updates-security-patches\/amp\/ Publish Date: 2026-04-24 16:34:00 Source Domain:…<\/p>\n","protected":false},"author":1,"featured_media":235286,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.bleepstatic.com\/content\/hl-images\/2026\/04\/24\/Cisco.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[24,32,34],"class_list":["post-235285","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity","tag-malware","tag-threat-actor"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/235285"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=235285"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/235285\/revisions"}],"predecessor-version":[{"id":235287,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/235285\/revisions\/235287"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/235286"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=235285"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=235285"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=235285"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}