Back Securityaffairs.Co

CISA reports persistent FIRESTARTER backdoor on Cisco ASA device in federal network

Securityaffairs.Co •Pierluigi Paganini • April 25, 2026

CISA said a federal Cisco Firepower ASA device was infected with the FIRESTARTER backdoor in Sept 2025, and it survived security patches. CISA revealed that a U.S. federal civilian agency’s Cisco Firepower device running ASA software was compromised in September 2025 by the FIRESTARTER backdoor. The malware reportedly persisted even after security patches were applied, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Persistent Firestarter Malware Targets Cisco Firepower Devices in US Agencies A sophisticated backdoor malware named Firestarter has been discovered on Cisco Firepower devices, attributed to the state-sponsored threat actor UAT-4356. The malware exploits two vulnerabilities, CVE-2025-20333 and CVE-2025-20362, which were patched in September 2025 but remain exploitable if devices were compromised prior to patching. Firestarter allows attackers to maintain persistent access even after firmware updates and standard reboots by manipulating the Cisco Service Platform mount list. The Cybersecurity and Infrastructure Security Agency (CISA) confirmed the presence of Firestarter on a U.S. federal agency's device, prompting an emergency directive for all federal civilian agencies to audit their Cisco firewall infrastructure. The malware can execute arbitrary code and has been linked to a broader campaign targeting government and critical infrastructure networks. Organizations are advised to conduct thorough security checks and utilize YARA rules for detection. The incident highlights the ongoing risks associated with unpatched vulnerabilities and the need for robust cybersecurity measures. 23 sources 79

Extracted Entities

CISA reports persistent FIRESTARTER backdoor on Cisco ASA device in federal network

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Platforms (1)