Loading malware…
LINE VIPER is a modular post-exploitation implant and user-mode shellcode loader used against Cisco Adaptive Security Appliance and Firepower Threat Defense devices, particularly Cisco ASA 5500-X series systems. It has been associated with the ArcaneDoor activity cluster and later intrusions linked by Cisco Talos to UAT-4356, also tracked as Storm-1849. In observed campaigns, attackers gained initial access by exploiting Cisco ASA/FTD WebVPN vulnerabilities including CVE-2025-20333 and CVE-2025-20362, then deployed LINE VIPER for device-level post-exploitation and, in some incidents, followed with FIRESTARTER or used RayInitiator to maintain persistence and reload the implant after reboot or upgrade.
LINE VIPER is loaded directly into device memory and can receive tasking through WebVPN client authentication traffic over HTTPS; reporting also describes an alternate command channel using ICMP with responses over raw TCP. Its capabilities include execution of privileged CLI commands, packet capture, bypass of VPN AAA controls for actor-controlled devices, suppression of selected syslog messages, harvesting of user CLI commands, forced delayed reboot, and access to sensitive device material such as configurations, administrative credentials, certificates, and private keys. It has also been used to establish illegitimate VPN sessions that bypass authentication policies.
The malware is designed for stealth and anti-forensics. It operates in memory, can hide packet-capture activity from normal administrative views, and has been reported to interfere with diagnostics by suppressing logging and intentionally rebooting devices. In the broader toolchain, RayInitiator serves as a GRUB bootkit on vulnerable Cisco ASA platforms without secure boot and loads LINE VIPER into memory, while FIRESTARTER has been used as a separate persistence mechanism that enables later redeployment of LINE VIPER even after patching. The activity has primarily affected government and other high-value perimeter networks, reflecting an espionage-oriented focus on network edge infrastructure.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2025-20333 (CVSSv3.1 skóre 9,9) sa nachádza v komponente VPN Web Server a spočíva v nedostatočnom overovaní používateľských vstupov v HTTP(S) požiadavkách. Vzdialený autentifikovaný útočník s platnými prihlasovacími údajmi VPN by zraniteľnosť zaslaním špeciálne vytvorených HTTP požiadaviek mohol zneužiť na vzdialené vykonanie kódu a získanie úplnej kontroly nad systémom. Zraniteľnosť je v súčasnosti aktívne zneužívaná. | Jeho primárnou úlohou je priamo do operačnej pamäte zariadenia načítať LINE VIPER, ktorý dokáže spúšťať CLI príkazy, zachytávať pakety, obchádzať VPN AAA, potlačiť správy syslog, zachytávať CLI príkazy a za účelom prevencie diagnostiky spôsobuje úmyselné reštarty zariadenia.
CVE-2025-20362 (CVSSv3.1 skóre 7,7) spočíva v nedostatočnom overovaní používateľských vstupov v rámci HTTP(S) požiadaviek s nedostatočnej implementácii mechanizmov autentifikácie. Vzdialený neautentifikovaný útočník by ju mohol zneužiť na obídenie mechanizmov autentifikácie a získanie prístupu k URL koncovým bodom, ktoré by mali byť prístupné len pre prihlásených používateľov. Zraniteľnosť je v súčasnosti aktívne zneužívaná. | Jeho primárnou úlohou je priamo do operačnej pamäte zariadenia načítať LINE VIPER, ktorý dokáže spúšťať CLI príkazy, zachytávať pakety, obchádzať VPN AAA, potlačiť správy syslog, zachytávať CLI príkazy a za účelom prevencie diagnostiky spôsobuje úmyselné reštarty zariadenia.
CISA added that the hackers deployed another strain of malware called Line Viper that established illegitimate virtual private network (VPN) sessions that bypassed all VPN authentication policies.
Cisco ASA Firewall Zero-Day Exploits Deploy RayInitiator and LINE VIPER Malware
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The attack chain begins with exploitation of known vulnerabilities (CVE-2025–20333, CVE-2025–20362) to gain initial access, followed by the deployment of LINE VIPER and FIRESTARTER to take control of the network device itself.
The attack chain begins with exploitation of known vulnerabilities (CVE-2025–20333, CVE-2025–20362) to gain initial access, followed by the deployment of LINE VIPER and FIRESTARTER to take control of the network device itself.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
This activity was associated with user accounts that existed but were no longer active within the agency [T1078].
CISA identified that APT actors first deployed LINE VIPER to establish illegitimate virtual private network (VPN) sessions [T1133] that bypassed all VPN authentication policies.
CVE-2025-20333 sa nachádza v komponente VPN Web Server ... Vzdialený autentifikovaný útočník s platnými prihlasovacími údajmi VPN by zraniteľnosť zaslaním špeciálne vytvorených HTTP požiadaviek mohol zneužiť na vzdialené vykonanie kódu... | CVE-2025-20362 ... Vzdialený neautentifikovaný útočník by ju mohol zneužiť na obídenie mechanizmov autentifikácie a získanie prístupu k URL koncovým bodom, ktoré by mali byť prístupné len pre prihlásených používateľov.
The hackers ... initially deployed a shellcode loader tracked by the U.K. National Cyber Security Center as Line Viper
FIRESTARTER attempts to install a hook – a way to intercept and modify normal operations – within LINA, the device’s core engine for network processing and security functions. This hook enables the execution of arbitrary shell code provided by the APT actors, including the deployment of LINE VIPER.
This activity was associated with user accounts that existed but were no longer active within the agency [T1078].
CISA identified that APT actors first deployed LINE VIPER to establish illegitimate virtual private network (VPN) sessions [T1133] that bypassed all VPN authentication policies.
CVE-2025–20333 (CVSS 9.9) affects the same WebVPN component and allows an authenticated remote attacker with valid VPN credentials to execute arbitrary code with root privileges.
This activity was associated with user accounts that existed but were no longer active within the agency [T1078].
za účelom prevencie diagnostiky spôsobuje úmyselné reštarty zariadenia.
FIRESTARTER attempts to install a hook – a way to intercept and modify normal operations – within LINA, the device’s core engine for network processing and security functions. This hook enables the execution of arbitrary shell code provided by the APT actors, including the deployment of LINE VIPER.
LINE VIPER enabled APT actors access to all configuration elements of the victim Firepower device, including administrative credentials, certificates, and private keys [T1082].
LINE VIPER is loaded into memory by RayInitiator and it receives command and control instructions over WebVPN client authentication sessions over HTTPS or via ICMP with responses over raw TCP.
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Post-exploitation toolkit used after initial access on Cisco ASA/FTD devices; described as enabling packet capture, VPN authentication bypass, syslog suppression, and credential harvesting, and as facilitating deployment of FIRESTARTER.
A user-mode shellcode loader used post-exploitation on Cisco devices to provide elevated access and facilitate deployment of FIRESTARTER. It can execute CLI commands, perform packet captures, bypass VPN AAA for actor devices, suppress syslog messages, harvest user CLI commands, and force a delayed reboot.
A post-exploitation implant used by APT actors on compromised Cisco ASA devices. In the described incident, it was deployed before FIRESTARTER and could be delivered/executed via FIRESTARTER’s hook and shellcode mechanism.
A post-exploitation toolkit used on compromised Cisco devices to execute CLI commands, capture packets, bypass VPN AAA for actor devices, suppress syslog messages, harvest user CLI commands, and force delayed reboots. It was deployed via FIRESTARTER-enabled access.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.