LINE VIPER
LINE VIPER is a modular user-mode shellcode loader and post-exploitation implant used against Cisco ASA and Firepower/Secure Firewall devices, especially Cisco ASA 5500-X series devices without secure boot. It has been observed in campaigns exploiting Cisco ASA/FTD WebVPN vulnerabilities CVE-2025-20333 and CVE-2025-20362, and is also loaded into memory by the RayInitiator GRUB bootkit. In observed intrusions, attackers deployed LINE VIPER first for post-exploitation access and later used FIRESTARTER as a persistence mechanism. CISA observed this sequence on a Cisco Firepower device at a U.S. federal civilian executive branch agency.
LINE VIPER receives command-and-control instructions over WebVPN client authentication sessions over HTTPS or via ICMP, with responses over raw TCP. It can establish illegitimate VPN sessions that bypass VPN authentication policies and AAA controls for actor devices. Reported capabilities include executing CLI commands with high privilege, performing hidden packet captures, suppressing syslog messages, harvesting user CLI commands, forcing delayed reboot, and accessing device configuration data including administrative credentials, certificates, and private keys. Reporting also states it facilitated broad file access on compromised devices.
The malware is associated with the broader Cisco-focused activity linked by Cisco to the ArcaneDoor threat actor cluster; some reporting ties the later related activity to UAT-4356 / Storm-1849, though public attribution for LINE VIPER-specific operations is not definitive in the provided content. High-confidence indicators and artifacts mentioned include use on Cisco ASA/FTD platforms, in-memory loading by RayInitiator, command delivery through crafted WebVPN authentication traffic, and use in conjunction with FIRESTARTER for longer-term persistence.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
According to their analysis, RayInitiator is a multi-stage Grand Unified Bootloader (GRUB) bootkit that services reboots and firmware upgrades. It also deploys the LINE VIPER shellcode loader to Cisco ASA 5500-X series devices that do not have secure boot. LINE VIPER is loaded into memory by RayInitiator and it receives command and control instructions over WebVPN client authentication sessions over HTTPS or via ICMP with responses over raw TCP.
According to their analysis, RayInitiator is a multi-stage Grand Unified Bootloader (GRUB) bootkit that services reboots and firmware upgrades. It also deploys the LINE VIPER shellcode loader to Cisco ASA 5500-X series devices that do not have secure boot. LINE VIPER is loaded into memory by RayInitiator and it receives command and control instructions over WebVPN client authentication sessions over HTTPS or via ICMP with responses over raw TCP.
CISA added that the hackers deployed another strain of malware called Line Viper that established illegitimate virtual private network (VPN) sessions that bypassed all VPN authentication policies.
Cisco ASA Firewall Zero-Day Exploits Deploy RayInitiator and LINE VIPER Malware
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The attack chain begins with exploitation of known vulnerabilities (CVE-2025–20333, CVE-2025–20362) to gain initial access, followed by the deployment of LINE VIPER and FIRESTARTER to take control of the network device itself.
The attack chain begins with exploitation of known vulnerabilities (CVE-2025–20333, CVE-2025–20362) to gain initial access, followed by the deployment of LINE VIPER and FIRESTARTER to take control of the network device itself.
Techniques & procedures
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques
Initial Access
This activity was associated with user accounts that existed but were no longer active within the agency [T1078].
Execution
3 techniques
Execution
These vulnerabilities allow attackers to execute arbitrary code, exfiltrate data and implant persistent malware to maintain access even after a device is rebooted.
The hackers ... initially deployed a shellcode loader tracked by the U.K. National Cyber Security Center as Line Viper
FIRESTARTER attempts to install a hook – a way to intercept and modify normal operations – within LINA, the device’s core engine for network processing and security functions. This hook enables the execution of arbitrary shell code provided by the APT actors, including the deployment of LINE VIPER.
Persistence
4 techniques
Persistence
This activity was associated with user accounts that existed but were no longer active within the agency [T1078].
Privilege Escalation
3 techniques
Privilege Escalation
CVE-2025–20333 (CVSS 9.9) affects the same WebVPN component and allows an authenticated remote attacker with valid VPN credentials to execute arbitrary code with root privileges.
Stealth
4 techniques
Stealth
LINE VIPER can execute CLI commands, perform packet captures, bypass VPN AAA for actor devices, suppress syslog messages, harvest user CLI commands, and force a delayed reboot.
This activity was associated with user accounts that existed but were no longer active within the agency [T1078].
LINE VIPER and RayInitiator utilise victim specific tokens... To check for a LINE VIPER request, the <group-select> element is verified to ensure it starts with a hard-coded, victim specific, 8-byte ASCII string... LINE VIPER tasking payloads sent to victim devices are checked for multiple victim-specific tokens before they are run.
FIRESTARTER attempts to install a hook – a way to intercept and modify normal operations – within LINA, the device’s core engine for network processing and security functions. This hook enables the execution of arbitrary shell code provided by the APT actors, including the deployment of LINE VIPER.
Credential Access
3 techniques
Credential Access
the LINE VIPER toolkit enables packet capture, VPN authentication bypass, syslog suppression, and credential harvesting
Discovery
3 techniques
Discovery
the LINE VIPER toolkit enables packet capture, VPN authentication bypass, syslog suppression, and credential harvesting
Collection
1 technique
Collection
Command and Control
5 techniques
Command and Control
LINE VIPER is loaded into memory by RayInitiator and it receives command and control instructions over WebVPN client authentication sessions over HTTPS or via ICMP with responses over raw TCP.
LINE VIPER is loaded into memory by RayInitiator and it receives command and control instructions over WebVPN client authentication sessions over HTTPS
Upon successful verification, the next stage of the malware is loaded by copying it into LINA’s memory and invoking mprotect to enable execution of the newly injected code.
Impact
1 technique
Impact
Recent activity
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Post-exploitation toolkit used after initial access on Cisco ASA/FTD devices; described as enabling packet capture, VPN authentication bypass, syslog suppression, and credential harvesting, and as facilitating deployment of FIRESTARTER.
A user-mode shellcode loader used post-exploitation on Cisco devices to provide elevated access and facilitate deployment of FIRESTARTER. It can execute CLI commands, perform packet captures, bypass VPN AAA for actor devices, suppress syslog messages, harvest user CLI commands, and force a delayed reboot.
A post-exploitation implant used by APT actors on compromised Cisco ASA devices. In the described incident, it was deployed before FIRESTARTER and could be delivered/executed via FIRESTARTER’s hook and shellcode mechanism.
A post-exploitation toolkit used on compromised Cisco devices to execute CLI commands, capture packets, bypass VPN AAA for actor devices, suppress syslog messages, harvest user CLI commands, and force delayed reboots. It was deployed via FIRESTARTER-enabled access.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.