Related Threat Clusters

Persistent Firestarter Malware Targets Cisco Firepower Devices in US Agencies
A sophisticated backdoor malware named Firestarter has been discovered on Cisco Firepower devices, attributed to the state-sponsored threat actor UAT-4356. The malware exploits two vulnerabilities, CVE-2025-20333 and…

37 articles · Updated April 23, 2026

Recent Intelligence Reports

CISA reports persistent FIRESTARTER backdoor on Cisco ASA device in federal network — Securityaffairs.Co · April 25, 2026
Firestarter malware survives Cisco firewall updates, security patches — Bleepingcomputer · April 24, 2026
FIRESTARTER Backdoor Hit Federal Cisco Firepower Device, Survives Security Patches — Thehackernews · April 24, 2026
CISA: Malware attack compromises US agency via Cisco exploit | brief — Scworld · April 24, 2026
CISA, NCSC issue Firestarter backdoor warning — Theregister · April 24, 2026
Governments on high alert after CISA snuffs out Firestarter backdoor on fed network — Theregister · April 24, 2026
Attackers Breach US Agency via Cisco Firewall Flaws, Distribute Firestarter Malware — Technadu · April 24, 2026
Acsc Issues High Status Alert For Cisco Firepower And Secure Firewall Products 1359732840 — www.govtechreview.com.au · April 24, 2026

ArcaneDoor Data Breach Malware Continued Attacks Against Cisco Firewalls Cisco Cybersecurity and Infrastructure Security Agency National Cyber Security Centre Talos China Iran North Korea Russia