Firestarter Malware Persists on Cisco ASA/Firepower Through Firmware Updates (CVE-2025-20333, CVE-2025-20362) — UAT-4356/ArcaneDoor

Firestarter Malware Persists on Cisco ASA/Firepower Through (TL-2026-0422), also tracked as Firestarter, is a critical-severity malware campaign scored CVSS 9.9, first published 2026-04-24. It is attributed to UAT-4356 (Russia) with high confidence, affects Cisco Adaptive Security Appliance (ASA) Software, references 2 CVEs (CVE-2025-20333, CVE-2025-20362), maps to 27 MITRE ATT&CK techniques (T1014, T1036, T1040), and is covered by 9 detection rules and 28 indicators of compromise.

Key facts for TL-2026-0422

Threat ID
TL-2026-0422
Also known as
Firestarter, ArcaneDoor 2026, Line Runner v3
Severity
CRITICAL
CVSS
9.9 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
MALWARE
First published
2026-04-24
Last reviewed
2026-04-24
Attribution
UAT-4356
Attribution confidence
HIGH
Nation-state nexus
Russia
Motivation
ESPIONAGE
Target sectors
government, defense, telecommunications, managed-service-providers, critical-infrastructure, federal-civilian
Target regions
North America, United States, United Kingdom, Western Europe, Canada, Australia
Detection rules
9
Indicators of compromise
28

Malware and tooling in Firestarter Malware Persists on Cisco ASA/Firepower Through

Malware and tooling: Firestarter, Line Dancer - S1186, Line Runner - S1188, custom ASA shellcode loader, custom HTTPS beacon + magic-packet passive backdoor + DNS tunneling

A joint US/UK cybersecurity advisory (CISA AR26-113A + NCSC) discloses 'Firestarter,' a custom implant deployed by the UAT-4356 (ArcaneDoor) cluster against Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) edge firewalls. Firestarter chains CVE-2025-20333 (VPN web server buffer overflow, CVSS 9.9 RCE) with CVE-2025-20362 (missing authorization on restricted URL, CVSS 6.5) to obtain unauthenticated root-equivalent code execution, hooks the LINA user-space process, modifies the CSP_MOUNT_LIST to relocate itself onto the persistent file system, and registers a signal handler that reinstalls the implant whenever the LINA process terminates — allowing it to survive firmware upgrades and Cisco security patches. CISA confirmed compromise of a US federal civilian executive branch agency dating to September 2025 and ordered emergency mitigation under ED 25-03.

How Firestarter Malware Persists on Cisco ASA/Firepower Through works

Firestarter is the third-generation ArcaneDoor implant family targeting Cisco ASA 5500-X and Firepower Threat Defense (FTD) appliances. UAT-4356 (tracked as STORM-1849 by Microsoft, ArcaneDoor by Cisco Talos) first came to public attention in April 2024 with the disclosure of the Line Dancer shellcode loader and Line Runner Lua backdoor. The campaign resurfaced in September 2025 when Cisco disclosed CVE-2025-20333 and CVE-2025-20362 under advisory cisco-sa-asaftd-webvpn-XXXX with confirmed in-the-wild exploitation; CISA issued Emergency Directive ED 25-03 the same day mandating patching or disconnection of affected devices across Federal Civilian Executive Branch (FCEB) agencies. On 2026-04-24, CISA's Cybersecurity Advisory AR26-113A — co-sealed by the UK NCSC, Australian ASD, and Canadian CCCS — published the full Firestarter technical analysis after forensic imaging of multiple compromised devices, including one at a US federal civilian agency where the implant had been resident since the initial September 2025 exploitation window.

The initial-access chain exploits CVE-2025-20333 — a stack-based buffer overflow in the HTTP server handling AnyConnect/Clientless SSL VPN requests — via a crafted POST to /+CSCOE+/logon.html when a session cookie triggers an unchecked memcpy into a fixed-size buffer, yielding unauthenticated remote code execution in the LINA process (CVSS 9.9, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). CVE-2025-20362 is a missing-authorization flaw in the same WebVPN component that allows an unauthenticated attacker to reach internal configuration URLs (e.g., /+CSCOE+/session_password.html, /+CSCOE+/saml/login) that are intended to require session validation; the operator uses this to probe for vulnerable builds and to exfiltrate configuration prior to the overflow. Combined, the two CVEs yield pre-authentication code execution on any ASA/FTD device exposing WebVPN to the internet, which according to Shodan telemetry numbered approximately 48,000 devices globally at the September 2025 disclosure.

Once code execution is achieved, Firestarter's first-stage shellcode allocates RWX memory inside the LINA process, resolves symbols from the in-memory ELF via its GOT, and overwrites the pointer table used by the LINA HTTP dispatch to hook two functions: lina_main_signal_handler() and set_cfg_http_service(). The implant then reads the current CSP_MOUNT_LIST variable — an ASA-specific environment pointer used at boot to stage the compressed root filesystem — and appends a path to /mnt/disk0/.fsck_ctx where it writes an encrypted copy of itself (RC4 key derived from the device serial number's SHA-1). On next boot, or when LINA is restarted for a firmware upgrade, the modified mount list causes the bootloader to include the attacker's directory; the signal handler installed previously catches SIGTERM/SIGKILL and re-executes the Firestarter loader before LINA actually exits. This makes standard upgrade procedures — which reboot LINA in-place — ineffective at evicting the implant, and even full firmware reimaging fails unless the operator wipes disk0 (which Cisco does not do by default).

Firestarter's command-and-control is split across three channels: (1) covert HTTPS beacons to attacker infrastructure over the device's own management interface, disguised as Cisco Smart Licensing traffic to *.cisco.com-hosted look-alike domains with valid Let's Encrypt certificates; (2) a passive backdoor on UDP/4500 (IPsec NAT-T) that only activates on receipt of a 48-byte magic packet containing an HMAC-SHA256 authenticator derived from a hard-coded key; and (3) a fallback DNS tunneling channel to dynamically-registered domains on the .top, .shop, and .click TLDs. Collected data — including VPN session tokens, AAA cache entries, and captured management-plane traffic — is exfiltrated in chunked 2048-byte AES-GCM-encrypted blobs. The implant includes anti-forensic measures: it hooks the 'show tech-support' command to hide its own processes and mount points, rotates its on-disk filename every 14 days, and zeroes its memory region if the LINA process receives SIGQUIT (used by Cisco diagnostic tools).

Attribution to UAT-4356 is rated HIGH-confidence by CISA and Cisco Talos based on: shared TTPs with the 2024 Line Runner campaign (CSP_MOUNT_LIST abuse is unique to this actor), reuse of C2 infrastructure previously attributed to UAT-4356 in VirusTotal pivots, overlap with Russian SVR (APT29) tooling patterns observed in the 2023 Solorigate campaigns, and operational timing consistent with Moscow business hours. The Western Five Eyes intelligence community assesses with high confidence that UAT-4356 is affiliated with the Russian Federation, though specific service attribution (SVR vs GRU) remains unpublished. Victimology is concentrated in government and telecommunications sectors across North America and Western Europe, with secondary targeting in defense-industrial-base and managed service providers supporting government clients.

MITRE ATT&CK techniques used in TL-2026-0422

Defense Evasion

T1014 Rootkit; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information

Credential Access

T1040 Network Sniffing; T1552 Unsecured Credentials

Exfiltration

T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol; T1090 Proxy; T1205 Traffic Signaling; T1573 Encrypted Channel

Execution

T1106 Native API; T1203 Exploitation for Client Execution

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1498 Network Denial of Service

Persistence

T1542 Pre-OS Boot; T1546 Event Triggered Execution

Resource Development

T1583 Acquire Infrastructure; T1588 Obtain Capabilities

Reconnaissance

T1590 Gather Victim Network Information; T1595 Active Scanning

defense-impairment

T1601 Modify System Image; T1685 Disable or Modify Tools

Collection

T1602 Data from Configuration Repository

Affected products and versions in Firestarter Malware Persists on Cisco ASA/Firepower Through

  • Cisco — Adaptive Security Appliance (ASA) Software
    Vulnerable versions: 9.12.x prior to EoSM; 9.14.x; 9.16.x prior to 9.16.4.85; 9.17.x prior to 9.17.1.45; 9.18.x prior to 9.18.4.22; 9.19.x prior to 9.19.1.28; 9.20.x prior to 9.20.3.10
    Fixed in: 9.16.4.85; 9.17.1.45; 9.18.4.22; 9.19.1.28; 9.20.3.10
  • Cisco — Firepower Threat Defense (FTD) Software
    Vulnerable versions: 6.4.x; 6.6.x; 6.7.x; 7.0.x prior to 7.0.8.1; 7.1.x; 7.2.x prior to 7.2.11; 7.3.x; 7.4.x prior to 7.4.2.3; 7.6.x prior to 7.6.0.1
    Fixed in: 7.0.8.1; 7.2.11; 7.4.2.3; 7.6.0.1
  • Cisco — ASA 5500-X Series Hardware
    Vulnerable versions: ASA 5506-X; ASA 5508-X; ASA 5512-X; ASA 5515-X; ASA 5516-X; ASA 5525-X; ASA 5545-X; ASA 5555-X; ASA 5585-X
    Fixed in: Hardware end-of-software-maintenance — replace with Firepower 1000/2100/3100 series
  • Cisco — Firepower 1000/2100/3100/4100/9300 Series
    Vulnerable versions: Devices running vulnerable FTD or ASA images
    Fixed in: See FTD/ASA fixed release matrix above

Remediation for Firestarter Malware Persists on Cisco ASA/Firepower Through

Patches

  • Cisco ASA: upgrade to 9.16.4.85 / 9.17.1.45 / 9.18.4.22 / 9.19.1.28 / 9.20.3.10 or later per cisco-sa-asaftd-webvpn advisory
  • Cisco Firepower Threat Defense: upgrade to 7.0.8.1 / 7.2.11 / 7.4.2.3 / 7.6.0.1 or later
  • Validate patch with 'show version | include Cisco Adaptive Security' and compare build to Cisco PSIRT fixed-release matrix

Immediate actions

  • Apply Cisco software updates for CVE-2025-20333 and CVE-2025-20362 on all ASA and Firepower Threat Defense devices immediately
  • Per CISA ED 25-03: disconnect any ASA/FTD device that cannot be patched within 24 hours from the public internet until patched
  • Perform full forensic triage on any device that was internet-exposed prior to September 25, 2025 — patching alone does not evict Firestarter
  • Capture a full 'core dump' and disk0 image from suspect devices and submit to CISA or Cisco TAC before reimaging
  • Block Firestarter C2 infrastructure (IPs and domains listed in IOCs) at upstream perimeter and DNS resolvers
  • Rotate all VPN credentials, AAA secrets, and pre-shared keys on any ASA/FTD previously exposed

Workarounds

  • If patching is not possible, disable AnyConnect SSL VPN and Clientless WebVPN on external interfaces: 'no webvpn enable outside' (operational impact)
  • Disable HTTPS server on externally-facing interfaces: 'no http server enable'
  • Apply ACL to restrict TCP/443 management access to known administrator source IPs until patched

Longer-term hardening

  • Remove ASA/FTD WebVPN and AnyConnect from the public internet where operationally possible; restrict to known source CIDRs
  • Deploy out-of-band management network for all edge firewalls; never expose management-plane interfaces to the internet
  • Stand up network detection analytics on firewall egress to identify low-and-slow HTTPS beacons to newly-registered domains
  • Implement device-attestation and boot-integrity monitoring (Cisco Secure Boot + platform hash checking where supported)
  • Plan migration away from end-of-software-maintenance ASA 5500-X hardware (ASA 5506/5508/5516/5525/5545/5555 reached end-of-SW-maintenance Aug 2024)

CVEs associated with Firestarter Malware Persists on Cisco ASA/Firepower Through

CVE-2025-20333, CVE-2025-20362

Weaknesses (CWE) in Firestarter Malware Persists on Cisco ASA/Firepower Through

CWE-121, CWE-787, CWE-862, CWE-285, CWE-506, CWE-1263

Timeline of Firestarter Malware Persists on Cisco ASA/Firepower Through

  • Cisco Talos publishes initial ArcaneDoor campaign analysis disclosing Line Dancer and Line Runner implants targeting ASA devices; UAT-4356 cluster named; CVE-2024-20353 and CVE-2024-20359 assigned.
  • Retrospective forensic analysis indicates UAT-4356 operators begin pre-positioning access on FCEB agency ASA devices using the not-yet-public CVE-2025-20333/20362 chain.
  • US federal civilian executive branch agency ASA 5585-X device compromised with Firestarter implant; access maintained undetected through subsequent maintenance windows.
  • CISA issues Emergency Directive ED 25-03 requiring all FCEB agencies to patch, disconnect, or conduct forensic imaging of internet-facing Cisco ASA/FTD devices within specified timelines.
  • Cisco publishes cisco-sa-asaftd-webvpn advisory for CVE-2025-20333 (CVSS 9.9 RCE) and CVE-2025-20362 (CVSS 6.5 missing authorization) with confirmed in-the-wild exploitation.
  • CVE-2025-20333 and CVE-2025-20362 added to CISA Known Exploited Vulnerabilities (KEV) catalog with accelerated remediation dates.
  • Mandiant/Google TAG publishes follow-on analysis observing continued UAT-4356 exploitation attempts against unpatched devices in government and telecom sectors.
  • Incident response team at compromised FCEB agency recovers full Firestarter binary during ASA device replacement; CISA and Cisco Talos begin joint reverse engineering effort.
  • Joint reverse engineering confirms Firestarter's CSP_MOUNT_LIST persistence mechanism survives both in-place firmware upgrades and Cisco's standard image reinstall procedure.
  • CISA publishes Cybersecurity Advisory AR26-113A co-sealed with UK NCSC, Australian ASD, and Canadian CCCS detailing Firestarter TTPs, IOCs, and mitigation guidance; BleepingComputer coverage amplifies awareness.
  • As of 2026-05-29, this is live: CVE-2025-20333/20362 are in CISA KEV and still exploited by UAT-4356/ArcaneDoor, with the patch-surviving Cisco ASA/FTD backdoor (CISA/NCSC, Apr 2026) requiring hard power-cycle/reimaging. CISA revised ED 25-03 in May 2026 over continued persistence; activity seen as recently as March 2026.

Sources cited for Firestarter Malware Persists on Cisco ASA/Firepower Through

Threats related to Firestarter Malware Persists on Cisco ASA/Firepower Through

Detection coverage for TL-2026-0422

As of 2026-04-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0422 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats