Hackers Exploit Cisco Firepower N

Gbhackers •Divya • April 24, 2026

A state- threat actor known as UAT-4356 is actively exploiting known vulnerabilities in Cisco Firepower devices to deploy a sophisticated custom backdoor. UAT-4356 exploited two n-day vulnerabilities, CVE-2025-20333 and CVE-2025-20362m affecting Cisco’s Firepower eXtensible Operating System (FXOS). These flaws allowed the threat actor to gain unauthorized access to targeted devices without requiring zero-day capabilities, instead weaponizing already-patched but unmitigated vulnerabilities […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Persistent Firestarter Malware Targets Cisco Firepower Devices in US Agencies A sophisticated backdoor malware named Firestarter has been discovered on Cisco Firepower devices, attributed to the state-sponsored threat actor UAT-4356. The malware exploits two vulnerabilities, CVE-2025-20333 and CVE-2025-20362, which were patched in September 2025 but remain exploitable if devices were compromised prior to patching. Firestarter allows attackers to maintain persistent access even after firmware updates and standard reboots by manipulating the Cisco Service Platform mount list. The Cybersecurity and Infrastructure Security Agency (CISA) confirmed the presence of Firestarter on a U.S. federal agency's device, prompting an emergency directive for all federal civilian agencies to audit their Cisco firewall infrastructure. The malware can execute arbitrary code and has been linked to a broader campaign targeting government and critical infrastructure networks. Organizations are advised to conduct thorough security checks and utilize YARA rules for detection. The incident highlights the ongoing risks associated with unpatched vulnerabilities and the need for robust cybersecurity measures. 23 sources 79

Extracted Entities

Hackers Exploit Cisco Firepower N

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

MITRE ATT&CK (1)

Platforms (1)