Loading malware…
FIRESTARTER is a Linux ELF backdoor used by advanced persistent threat actors to maintain covert, durable access on Cisco Firepower and Secure Firewall appliances running Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD) software. It has been associated with activity tracked as UAT-4356, also referred to in some reporting as Storm-1849, and linked to the broader ArcaneDoor intrusion set. The malware has been observed after exploitation of Cisco ASA vulnerabilities including CVE-2025-20333 and CVE-2025-20362, which provided initial access to exposed perimeter devices.
FIRESTARTER functions as a device-native implant and command-and-control backdoor. It attempts to hook the LINA process, a core Cisco engine responsible for network processing and security functions, and enables execution of attacker-supplied shellcode in memory. The implant hijacks WebVPN request handling by detouring an XML handler so that specially crafted requests can trigger staged payload loading and arbitrary code execution while normal traffic continues to be processed, reducing the chance of detection. In observed intrusions, attackers deployed LINE VIPER before or alongside FIRESTARTER as a post-exploitation component, with FIRESTARTER then used to preserve long-term access and facilitate re-entry.
A defining characteristic of FIRESTARTER is its persistence on network appliances even after standard remediation steps. It survives normal reboots and firmware updates by manipulating Cisco service platform startup behavior and reinstalling itself during graceful restart conditions. It also performs cleanup actions intended to reduce forensic visibility, including restoring modified configuration elements, deleting temporary artifacts, suppressing errors, and timestomping files. Public reporting has emphasized that patching a previously compromised device does not necessarily remove the implant, and that eradication may require a hard power cycle or full reimaging depending on platform and operating mode.
FIRESTARTER has been observed targeting government environments and is assessed to pose broader risk to critical national infrastructure and other organizations operating internet-exposed Cisco perimeter devices. Because it resides on trusted security appliances rather than conventional endpoints, successful compromise can provide attackers with durable remote control, post-exploitation access, and visibility into sensitive edge traffic while bypassing many endpoint-focused defenses. Detection has been reported to rely primarily on memory analysis and forensic examination rather than conventional log-based analytics.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Die Verwundbarkeiten erhielten die Kennungen CVE-2025-20333 (CVSS: 9.9), CVE-2025-20362 (CVSS: 6.5) und CVE-2025-20363 (CVSS: 9.0). Mit den Advisories gab Cisco auch bekannt, dass die ersten beiden Schwachstellen bereits ausgenutzt werden ... Cisco Talos zeigt ... dass der Akteur UAT-4356 ... die bereits bekannten Sicherheitslücken CVE-2025-20333 und CVE-2025-20362 genutzt [hat], um unauthorisierten Zugriff ... zu erlangen und die Backdoor FIRESTARTER zu installieren. | Cisco Talos zeigt in diesem Zusammenhang auf, dass der Akteur UAT-4356 die Angriffe auf Cisco Firepower-Instanzen nach der Veröffentlichung des Patches im September fortgeführt hat. Dabei wurden die bereits bekannten Sicherheitslücken CVE-2025-20333 und CVE-2025-20362 genutzt, um unauthorisierten Zugriff auf den Geräten zu erlangen und die Backdoor FIRESTARTER zu installieren.
Die Verwundbarkeiten erhielten die Kennungen CVE-2025-20333 (CVSS: 9.9), CVE-2025-20362 (CVSS: 6.5) und CVE-2025-20363 (CVSS: 9.0). Mit den Advisories gab Cisco auch bekannt, dass die ersten beiden Schwachstellen bereits ausgenutzt werden ... Cisco Talos zeigt ... dass der Akteur UAT-4356 ... die bereits bekannten Sicherheitslücken CVE-2025-20333 und CVE-2025-20362 genutzt [hat], um unauthorisierten Zugriff ... zu erlangen und die Backdoor FIRESTARTER zu installieren. | Cisco Talos zeigt in diesem Zusammenhang auf, dass der Akteur UAT-4356 die Angriffe auf Cisco Firepower-Instanzen nach der Veröffentlichung des Patches im September fortgeführt hat. Dabei wurden die bereits bekannten Sicherheitslücken CVE-2025-20333 und CVE-2025-20362 genutzt, um unauthorisierten Zugriff auf den Geräten zu erlangen und die Backdoor FIRESTARTER zu installieren.
CISA said the unnamed department was infected with malware called “FIRESTARTER” that allowed the hackers to return to the Cisco device in March without re-exploiting the original vulnerabilities.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This actor, DoNot, recently started using a new malware loader we're calling "Firestarter."
Cisco Talos zeigt in diesem Zusammenhang auf, dass der Akteur UAT-4356 die Angriffe auf Cisco Firepower-Instanzen nach der Veröffentlichung des Patches im September fortgeführt hat. Dabei wurden die bereits bekannten Sicherheitslücken CVE-2025-20333 und CVE-2025-20362 genutzt, um unauthorisierten Zugriff auf den Geräten zu erlangen und die Backdoor FIRESTARTER zu installieren.
In April 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the UK’s National Cyber Security Centre (NCSC) released a joint advisory on a newly identified backdoor named “FIRESTARTER,” deployed by the state-linked APT group UAT-4356 targeting Cisco Firepower devices.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
Once the file arrives, the malware will import the classes from the payload, and being now able to start the malicious service... Once the payload is on the victim device, the loader will load the classes and start the malicious service.
Key Characteristics Written to operate inside the LINA process, a core Cisco firewall component Executes attacker-supplied shellcode directly in memory
When an attacker sends a specially crafted WebVPN authentication request containing a specific “magic packet” pattern, arbitrary shellcode is executed within the LINA process.
Dabei wurden die bereits bekannten Sicherheitslücken CVE-2025-20333 und CVE-2025-20362 genutzt, um unauthorisierten Zugriff auf den Geräten zu erlangen und die Backdoor FIRESTARTER zu installieren.
Upon successful verification of identification, the next stage of the malware is loaded by copying it into LINA’s memory and invoking mprotect to enable execution of the newly injected code [T1543].
The malware injects a block of shellcode 0x200 bytes before the end of the library’s text segment, installing the detour for the XML element handler [T1055].
Cisco Talos zeigt in diesem Zusammenhang auf, dass der Akteur UAT-4356 die Angriffe auf Cisco Firepower-Instanzen nach der Veröffentlichung des Patches im September fortgeführt hat. Dabei wurden die bereits bekannten Sicherheitslücken CVE-2025-20333 und CVE-2025-20362 genutzt, um unauthorisierten Zugriff auf den Geräten zu erlangen und die Backdoor FIRESTARTER zu installieren.
Upon successful verification of identification, the next stage of the malware is loaded by copying it into LINA’s memory and invoking mprotect to enable execution of the newly injected code [T1543].
TA0005 – Defense Evasion: Operating as fileless malware, restoring modified configurations after execution, and blending malicious activity into legitimate firewall and VPN request handling.
The first execution of the loader provides a lure to make the victim believe that there was no malicious install. Once the message of uninstallation is shown, the icon is removed from the user interface... If the user checks the permissions, it can see that they exist but with the name "System Service," which is made to deceive the user into thinking that it's seeing system related permissions and not the application permissions.
Upon execution, FIRESTARTER accesses its own binary located at /usr/bin/lina_cs on the device [T1036.005] and copies its contents into memory.
The malware injects a block of shellcode 0x200 bytes before the end of the library’s text segment, installing the detour for the XML element handler [T1055].
After the reboot, it restores the original mount list and removes related files from disk to erase traces.
These commands delete the modified CSP_MOUNT_LIST file [T1070.004] restoring the original CSP_MOUNT_LIST.
Execute permissions are granted to any user, the owner and timestamp are set to match the original [T1070.006], and the temporary file is then deleted.
When an attacker sends a specially crafted WebVPN authentication request containing a specific “magic packet” pattern, arbitrary shellcode is executed within the LINA process.
The process enumerates LINA’s virtual memory map to locate the private read-write (rw-p) segment associated with lina [T1057].
It will send information regarding the victim's identity and geolocation, both crucial for the next steps the operators will perform. After getting the Google FMC token (Step 1) the operators have everything they need to send the Google FMC message containing the URL for the malware to download the payload. They also have the geographic location, IP address, IMEI and email address from the victims, allowing them to decide which victims should receive the payload.
DoNot is now leveraging Google Firebase Cloud Messaging (Google FCM) as a mandatory communication channel with the malware. This communication channel is encrypted and mixed among other communications performed by Android Operating System with the Google infrastructure...
When the malware receives a message from Google FMC, it checks if it contains a key called "link." If that exists, it will check if it starts with "https," if everything checks out, it will use the link to download the payload from a hosting server. Once the file arrives, the malware will import the classes from the payload...
When an attacker sends a specially crafted WebVPN authentication request containing a specific “magic packet” pattern, arbitrary shellcode is executed within the LINA process.
skadevaren er en persistent bakdør som ved vellykket kompromittering tillater vedvarende fjerntilgang til systemet
The newly discovered Firestarter malware uses Google Firebase Cloud Messaging to notify its authors of the final payload location. Even if the command and control (C2) is taken down, the DoNot team can still redirect the malware to another C2 using Google infrastructure.
25 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced only by headline as a backdoor in separate related content, not part of the main SharePoint flaw discussion.
Referenced only as a related backdoor analysis targeting Cisco ASA; no further behavioral detail is provided in this content.
Custom backdoor for Cisco Firepower/ASA/FTD devices that hooks the LINA process to execute attacker-supplied shellcode via crafted WebVPN requests and maintains persistence across soft reboots and firmware updates.
Governments on high alert after CISA snuffs out Firestarter backdoor on fed network
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.