Firestarter Malware Persists on Cisco ASA/Firepower Through Firmware Updates (CVE-2025-20333, CVE-2025-20362) — UAT-4356/ArcaneDoor — Threadlinqs Intelligence
As of 2026-05-30, Firestarter Malware Persists on Cisco ASA/Firepower Through Firmware Updates (CVE-2025-20333, CVE-2025-20362) — UAT-4356/ArcaneDoor is a critical-severity malware threat attributed to UAT-4356 (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-0422 · Severity: CRITICAL · CVSS: 9.9 · Status: ACTIVE · Category: MALWARE
Attribution: UAT-4356 · Russia · ESPIONAGE
A joint US/UK cybersecurity advisory (CISA AR26-113A + NCSC) discloses 'Firestarter,' a custom implant deployed by the UAT-4356 (ArcaneDoor) cluster against Cisco Adaptive Security Appliance (ASA) and
Firestarter is the third-generation ArcaneDoor implant family targeting Cisco ASA 5500-X and Firepower Threat Defense (FTD) appliances. UAT-4356 (tracked as STORM-1849 by Microsoft, ArcaneDoor by Cisco Talos) first came to public attention in April 2024 with the disclosure of the Line Dancer shellcode loader and Line Runner Lua backdoor. The campaign resurfaced in September 2025 when Cisco disclosed CVE-2025-20333 and CVE-2025-20362 under advisory cisco-sa-asaftd-webvpn-XXXX with confirmed in-the-wild exploitation; CISA issued Emergency Directive ED 25-03 the same day mandating patching or disconnection of affected devices across Federal Civilian Executive Branch (FCEB) agencies. On 2026-04-24, CISA's Cybersecurity Advisory AR26-113A — co-sealed by the UK NCSC, Australian ASD, and Canadian CCCS — published the full Firestarter technical analysis after forensic imaging of multiple compromised devices, including one at a US federal civilian agency where the implant had been resident since the initial September 2025 exploitation window.
The initial-access chain exploits CVE-2025-20333 — a stack-based buffer overflow in the HTTP server handling AnyConnect/Clientless SSL VPN requests — via a crafted POST to /+CSCOE+/logon.html when a session cookie triggers an unchecked memcpy into a fixed-size buffer, yielding unauthenticated remote code execution in the LINA process (CVSS 9.9, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). CVE-2025-20362 is a missing-authorization flaw in the same WebVPN component that allows an unauthenticated attacker to reach internal configuration URLs (e.g., /+CSCOE+/session_password.html, /+CSCOE+/saml/login) that are intended to require session validation; the operator uses this to probe for vulnerable builds and to exfiltrate configuration prior to the overflow. Combined, the two CVEs yield pre-authentication code execution on any ASA/FTD device exposing WebVPN to the internet, which according to Shodan telemetry numbered approximately 48,000 devices globally at the September 2025 disclosure.
Once code execution is achieved, Firestarter's first-stage shellcode allocates RWX memory inside the LINA process, resolves symbols from the in-memory ELF via its GOT, and overwrites the pointer table used by the LINA HTTP dispatch to hook two functions: lina_main_signal_handler() and set_cfg_http_service(). The implant then reads the current CSP_MOUNT_LIST variable — an ASA-specific environment pointer used at boot to stage the compressed root filesystem — and appends a path to /mnt/disk0/.fsck_ctx where it writes an encrypted copy of itself (RC4 key derived from the device serial number's SHA-1). On next boot, or when LINA is restarted for a firmware upgrade, the modified mount list causes the bootloader to include the attacker's directory; the signal handler installed previously catches SIGTERM/SIGKILL and re-executes the Firestarter loader before LINA actually exits. This makes standard upgrade procedures — which reboot LINA in-place — ineffective at evicting the implant, and even full firmware reimaging fails unless the operator wipes disk0 (which Cisco does not do by default).
Firestarter's command-and-control is split across three channels: (1) covert HTTPS beacons to attacker infrastructure over the device's own management interface, disguised as Cisco Smart Licensing traffic to *.cisco.com-hosted look-alike domains with valid Let's Encrypt certificates; (2) a passive backdoor on UDP/4500 (IPsec NAT-T) that only activates on receipt of a 48-byte magic packet containing an HMAC-SHA256 authenticator derived from a hard-coded key; and (3) a fallback DNS tunneling channel to dynamically-registered domains on the .top, .shop, and .click TLDs. Collected data — including VPN session tokens, AAA cache entries, and captured management-plane traffic — is exfiltrated in chunked 2048-byte AES-GCM-encrypted blobs. The implant includes anti-forensic measures: it hooks the 'show tech-support' command to hide its own processes and
Weaknesses (CWE)
CWE-121, CWE-787, CWE-862, CWE-285, CWE-506, CWE-1263
Target sectors: government, defense, telecommunications, managed-service-providers, critical-infrastructure, federal-civilian
Target regions: North America, United States, United Kingdom, Western Europe, Canada, Australia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, CRITICAL, threat intelligence, cybersecurity, CVE-2025-20333, CVE-2025-20362, T1595, T1590, T1583, T1588, T1588, T1190, T1203, T1106, T1542, T1601