FIRESTARTER Backdoor Hit Federal Cisco Firepower Device, Survives Security Patches

Back Thehackernews

FIRESTARTER Backdoor Hit Federal Cisco Firepower Device, Survives Security Patches

Thehackernews •[email protected] (The Hacker News) • April 24, 2026

Share: View original

Learn how to stop patient zero attacks before they bypass detection and compromise your systems at entry points.

Learn how to validate real attack paths and reduce exploitable risk with continuous agentic security validation.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Persistent Firestarter Malware Targets Cisco Firepower Devices in US Agencies A sophisticated backdoor malware named Firestarter has been discovered on Cisco Firepower devices, attributed to the state-sponsored threat actor UAT-4356. The malware exploits two vulnerabilities, CVE-2025-20333 and CVE-2025-20362, which were patched in September 2025 but remain exploitable if devices were compromised prior to patching. Firestarter allows attackers to maintain persistent access even after firmware updates and standard reboots by manipulating the Cisco Service Platform mount list. The Cybersecurity and Infrastructure Security Agency (CISA) confirmed the presence of Firestarter on a U.S. federal agency's device, prompting an emergency directive for all federal civilian agencies to audit their Cisco firewall infrastructure. The malware can execute arbitrary code and has been linked to a broader campaign targeting government and critical infrastructure networks. Organizations are advised to conduct thorough security checks and utilize YARA rules for detection. The incident highlights the ongoing risks associated with unpatched vulnerabilities and the need for robust cybersecurity measures. 23 sources 79

Extracted Entities

Attack Types (1)

Malware (1)