# Firestarter Malware Persists on Cisco ASA/Firepower Through Firmware Updates (CVE-2025-20333, CVE-2025-20362) — UAT-4356/ArcaneDoor

> A joint US/UK cybersecurity advisory (CISA AR26-113A + NCSC) discloses 'Firestarter,' a custom implant deployed by the UAT-4356 (ArcaneDoor) cluster against Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) edge firewalls. Firestarter chains CVE-2025-20333 (VPN web server buffer overflow, CVSS 9.9 RCE) with CVE-2025-20362 (missing authorization on restricted URL, CVSS 6.5) to obtain unauthenticated root-equivalent code execution, hooks the LINA user-space process, modifies the CSP_MOUNT_LIST to relocate itself onto the persistent file system, and registers a signal handler that reinstalls the implant whenever the LINA process terminates — allowing it to survive firmware upgrades and Cisco security patches. CISA confirmed compromise of a US federal civilian executive branch agency dating to September 2025 and ordered emergency mitigation under ED 25-03.

- **Published:** 2026-04-24T12:00:00Z
- **Last reviewed:** 2026-04-24T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0422
- **ID:** TL-2026-0422
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** UAT-4356 (Russia)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-20333, CVE-2025-20362

## Description

Firestarter is the third-generation ArcaneDoor implant family targeting Cisco ASA 5500-X and Firepower Threat Defense (FTD) appliances. UAT-4356 (tracked as STORM-1849 by Microsoft, ArcaneDoor by Cisco Talos) first came to public attention in April 2024 with the disclosure of the Line Dancer shellcode loader and Line Runner Lua backdoor. The campaign resurfaced in September 2025 when Cisco disclosed CVE-2025-20333 and CVE-2025-20362 under advisory cisco-sa-asaftd-webvpn-XXXX with confirmed in-the-wild exploitation; CISA issued Emergency Directive ED 25-03 the same day mandating patching or disconnection of affected devices across Federal Civilian Executive Branch (FCEB) agencies. On 2026-04-24, CISA's Cybersecurity Advisory AR26-113A — co-sealed by the UK NCSC, Australian ASD, and Canadian CCCS — published the full Firestarter technical analysis after forensic imaging of multiple compromised devices, including one at a US federal civilian agency where the implant had been resident since the initial September 2025 exploitation window.

The initial-access chain exploits CVE-2025-20333 — a stack-based buffer overflow in the HTTP server handling AnyConnect/Clientless SSL VPN requests — via a crafted POST to /+CSCOE+/logon.html when a session cookie triggers an unchecked memcpy into a fixed-size buffer, yielding unauthenticated remote code execution in the LINA process (CVSS 9.9, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). CVE-2025-20362 is a missing-authorization flaw in the same WebVPN component that allows an unauthenticated attacker to reach internal configuration URLs (e.g., /+CSCOE+/session_password.html, /+CSCOE+/saml/login) that are intended to require session validation; the operator uses this to probe for vulnerable builds and to exfiltrate configuration prior to the overflow. Combined, the two CVEs yield pre-authentication code execution on any ASA/FTD device exposing WebVPN to the internet, which according to Shodan telemetry numbered approximately 48,000 devices globally at the September 2025 disclosure.

Once code execution is achieved, Firestarter's first-stage shellcode allocates RWX memory inside the LINA process, resolves symbols from the in-memory ELF via its GOT, and overwrites the pointer table used by the LINA HTTP dispatch to hook two functions: lina_main_signal_handler() and set_cfg_http_service(). The implant then reads the current CSP_MOUNT_LIST variable — an ASA-specific environment pointer used at boot to stage the compressed root filesystem — and appends a path to /mnt/disk0/.fsck_ctx where it writes an encrypted copy of itself (RC4 key derived from the device serial number's SHA-1). On next boot, or when LINA is restarted for a firmware upgrade, the modified mount list causes the bootloader to include the attacker's directory; the signal handler installed previously catches SIGTERM/SIGKILL and re-executes the Firestarter loader before LINA actually exits. This makes standard upgrade procedures — which reboot LINA in-place — ineffective at evicting the implant, and even full firmware reimaging fails unless the operator wipes disk0 (which Cisco does not do by default).

Firestarter's command-and-control is split across three channels: (1) covert HTTPS beacons to attacker infrastructure over the device's own management interface, disguised as Cisco Smart Licensing traffic to *.cisco.com-hosted look-alike domains with valid Let's Encrypt certificates; (2) a passive backdoor on UDP/4500 (IPsec NAT-T) that only activates on receipt of a 48-byte magic packet containing an HMAC-SHA256 authenticator derived from a hard-coded key; and (3) a fallback DNS tunneling channel to dynamically-registered domains on the .top, .shop, and .click TLDs. Collected data — including VPN session tokens, AAA cache entries, and captured management-plane traffic — is exfiltrated in chunked 2048-byte AES-GCM-encrypted blobs. The implant includes anti-forensic measures: it hooks the 'show tech-support' command to hide its own processes and mount points, rotates its on-disk filename every 14 days, and zeroes its memory region if the LINA process receives SIGQUIT (used by Cisco diagnostic tools).

Attribution to UAT-4356 is rated HIGH-confidence by CISA and Cisco Talos based on: shared TTPs with the 2024 Line Runner campaign (CSP_MOUNT_LIST abuse is unique to this actor), reuse of C2 infrastructure previously attributed to UAT-4356 in VirusTotal pivots, overlap with Russian SVR (APT29) tooling patterns observed in the 2023 Solorigate campaigns, and operational timing consistent with Moscow business hours. The Western Five Eyes intelligence community assesses with high confidence that UAT-4356 is affiliated with the Russian Federation, though specific service attribution (SVR vs GRU) remains unpublished. Victimology is concentrated in government and telecommunications sectors across North America and Western Europe, with secondary targeting in defense-industrial-base and managed service providers supporting government clients.

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1106 Native API
- T1542 Pre-OS Boot
- T1601 Modify System Image
- T1546 Event Triggered Execution
- T1068 Exploitation for Privilege Escalation
- T1014 Rootkit
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1140 Deobfuscate/Decode Files or Information
- T1040 Network Sniffing
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1602 Data from Configuration Repository
- T1071 Application Layer Protocol
- T1205 Traffic Signaling
- T1090 Proxy
- T1573 Encrypted Channel
- T1048 Exfiltration Over Alternative Protocol
- T1041 Exfiltration Over C2 Channel
- T1498 Network Denial of Service

## Sources

- [CISA Advisory AR26-113A: Firestarter Malware Analysis Report](https://www.cisa.gov/news-events/cybersecurity-advisories/ar26-113a)
- [NCSC Joint Advisory: Firestarter Implant on Cisco Edge Devices](https://www.ncsc.gov.uk/news/firestarter-cisco-edge-advisory)
- [CISA Emergency Directive ED 25-03: Mitigate Cisco Vulnerabilities](https://www.cisa.gov/news-events/directives/ed-25-03)
- [Cisco Security Advisory cisco-sa-asaftd-webvpn: CVE-2025-20333, CVE-2025-20362](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn)
- [BleepingComputer: Firestarter malware survives Cisco firewall updates](https://www.bleepingcomputer.com/news/security/firestarter-malware-survives-cisco-firewall-updates-security-patches/)
- [Cisco Talos: ArcaneDoor — new espionage-focused campaign found targeting perimeter network devices](https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/)
- [Microsoft Security: STORM-1849 activity targeting network edge devices](https://www.microsoft.com/en-us/security/blog/storm-1849-edge-devices)
- [NVD CVE-2025-20333 Record](https://nvd.nist.gov/vuln/detail/CVE-2025-20333)
- [NVD CVE-2025-20362 Record](https://nvd.nist.gov/vuln/detail/CVE-2025-20362)
- [CISA KEV Catalog Entries: CVE-2025-20333, CVE-2025-20362](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Mandiant/Google TAG: ArcaneDoor follow-on activity against government sector](https://cloud.google.com/blog/topics/threat-intelligence/arcanedoor-followup)
- [SANS ISC: Firestarter Cisco ASA memory forensics walkthrough](https://isc.sans.edu/diary/firestarter-asa-memory-forensics)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0422