A state‑sponsored threat actor identified as UAT‑4356 has deployed a persistent backdoor known as Firestarter on Cisco Firepower and ASA devices, enabling long‑term access even after organizations applied patches. This campaign reflects a growing shift toward targeting network edge devices, where traditional endpoint visibility is limited. Cisco Talos Blog
How UAT‑4356 Gained Access
Cisco Talos confirms that UAT‑4356 exploited two Cisco zero‑day vulnerabilities — CVE‑2025‑20333 and CVE‑2025‑20362 — to gain unauthorized access to ASA and Firepower Threat Defense (FTD) appliances. These flaws allowed attackers to execute code and bypass authorization controls, providing the foothold needed to implant Firestarter. Cisco Talos Blog +3
These vulnerabilities were exploited in the wild as part of a broader campaign linked to the earlier ArcaneDoor espionage operation.
How Firestarter Works
1. Persistence Through CSP_MOUNT_LIST Manipulation
Firestarter achieves persistence by modifying the Cisco Service Platform mount list (CSP_MOUNT_LIST). This allows the malware to execute during the device’s boot sequence, surviving reboots and even firmware updates.
The implant:
- Writes itself to a backup location
- Restores the original mount list after execution
- Removes traces of the trojanized file
This “transient persistence” means the backdoor remains active unless the device undergoes a full hard power cycle, not just a software reboot.
2. Injecting Shellcode Into LINA
Firestarter injects malicious shellcode into LINA, the core process that powers Cisco ASA and FTD devices. This gives attackers the ability to:
- Execute arbitrary code
- Intercept VPN authentication requests
- Maintain covert access without re‑exploiting vulnerabilities
CISA’s analysis confirms Firestarter operates as a fully functional backdoor capable of remote command execution.
Why Firestarter Is Hard to Remove
CISA warns that Firestarter can survive patching and normal reboots, meaning organizations may believe they remediated the intrusion while the attacker’s foothold remains intact. Only a hard power cycle reliably removes the implant.
This persistence model directly challenges the common “patch‑and‑reboot” remediation workflow used by many network teams.
Why This Attack Matters
1. Edge Devices Are the New Target Surface
Firestarter reinforces a trend: state‑sponsored actors are increasingly targeting perimeter devices — firewalls, VPN gateways, and routers — because they sit outside traditional endpoint monitoring.
2. Post‑Patching Persistence Is a Game‑Changer
The ability to remain active after firmware updates means organizations cannot rely solely on patching to evict attackers.
3. Government and Critical Infrastructure Are at Risk
CISA’s emergency directive highlights the severity of the threat for federal agencies and critical infrastructure operators.
Recommended Defensive Actions
- Perform a hard power cycle on affected Cisco devices
- Collect and submit core dumps for forensic analysis (per CISA guidance)
- Use YARA rules provided by CISA to detect Firestarter in disk images or memory dumps
- Review device logs for unauthorized modifications to CSP_MOUNT_LIST
- Validate integrity of LINA and related binaries
- Strengthen monitoring of VPN authentication flows
- Treat any device exposed to CVE‑2025‑20333 or CVE‑2025‑20362 as potentially compromised
Leave a Reply