Firestarter: the malware that persists on Cisco Firepower despite patches and updates

A custom malware called Firestarter has been discovered persisting on Cisco Firepower and Secure Firewall devices, even after applying security patches. The backdoor has been attributed to a cyberattack that Cisco Talos tracks as UAT-4356, known for cyberspying campaigns, including Operation ArcaneDoor.

Exploited vulnerabilities and initial access

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the UK National Cyber Security Center (NCSC) believe the threat actor gained initial access by exploiting two critical vulnerabilities: a missing authorization issue (CVE-2025-20333) and a buffer overflow bug (CVE-2025-20362). In an incident observed at a civilian federal agency, the threat actor first deployed the Line Viper malware, a user-mode shellcode loader, followed by Firestarter, which enables continuous access even after patching.

Advanced persistence mechanisms

Firestarter maintains persistence through reboots, firmware updates, and security patches. The backdoor automatically restarts if terminated and integrates into the LINA process, the core of Cisco ASA, using signal handlers that trigger reinstallation routines. The malware modifies the CSPMOUNTLIST boot/mount file to ensure execution at startup, stores a copy of itself in /opt/cisco/platform/logs/var/log/svcsamcore.log and restores it to /usr/bin/linacs, where it runs in the background.

Backdoor functionality and remote access

The primary function of Firestarter is to act as a backdoor for remote access, with the ability to execute shellcode provided by the attacker. This is achieved through a mechanism that links Firestarter to LINA by modifying an XML handler and injecting shellcode into memory, creating a controlled execution path. The shellcode is triggered by a specially crafted WebVPN request, which, after validating a hardcoded identifier, loads and executes payloads provided by the attacker directly into memory.

Mitigation and detection recommendations

Cisco has published a security advisory that includes mitigations and workarounds to remove the persistence mechanism, as well as indicators of compromise to discover the Firestarter implant. Cisco strongly recommends reimaging and updating the device using the correct versions, both for affected and unaffected devices.

Operational Risks and Temporary Solutions

A cold reboot can eliminate Firestarter but carries significant risks: 15% of devices tested by Cisco experienced disk corruption after such an operation. For environments where reimaging is impossible, Cisco suggests isolating compromised devices and closely monitoring VPN traffic. However, this is a temporary solution: Talos researchers have observed that Firestarter can re-emerge even after months of inactivity.

YARA Rules: How They Work

The YARA rules shared by CISA are specifically designed to identify the unique signatures of Firestarter. For example, the rule FirestarterPersistence looks for modified file patterns in the path /usr/bin/lina_cs. However, these rules require a memory dump or disk image, meaning administrators must have physical access to the compromised devices.

Legal Implications and Compliance

The presence of Firestarter can violate security standards such as ISO 27001 or NIST SP 800-53, with potential legal consequences. In Europe, GDPR requires notification of breaches within 72 hours, while in the U.S., sectors like energy must comply with directives from the Department of Energy. Affected companies could face fines, reputational damage, and high remediation costs.

Forensic Analysis Tools

For in-depth analysis, investigators can use tools like Volatility or REMnux to examine memory dumps. The Talos report provides indicators of compromise (IOCs) such as MD5 hashes, IP addresses, and domains linked to Firestarter. This data can be integrated into SIEM systems to detect suspicious activity.

Future Outlook: The Evolution of Threats

Experts predict that advanced actors will continue to develop malware with increasingly sophisticated persistence mechanisms. An emerging trend is the use of "living off the land" (LOL) techniques, where attackers exploit legitimate system operating tools to evade detection. This makes continuous IT staff training and the adoption of AI-based security solutions even more critical.

Final Recommendations

  • Continuous Monitoring: Implement behavior analysis solutions (UEBA) to detect anomalous activity.
  • Disaster Recovery Planning: Have a detailed plan for reimaging and restoring compromised devices.
  • Collaboration with the Community: Share information with other organizations and government agencies to improve collective resilience.

Frequently Asked Questions

Q: Can Firestarter spread to other devices on the network?
A: Currently, there is no evidence that Firestarter has self-propagation capabilities. However, it can be used to execute remote commands that might facilitate the spread of other malware.

Q: What are the signs of a Firestarter infection?
A: Signs include unexpected reboots, degraded performance, and suspicious VPN traffic. Administrators should also monitor logs for anomalous activity in LINA processes.

Q: Are there software patches for Firestarter?
A: Cisco has released patches for vulnerabilities CVE-2025-20333 and CVE-2025-20362, but these do not remove the already installed malware. A complete reimaging of the device is necessary.

Editorial Note and Disclaimer

The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.

GoYou does not constitute a journalistic publication or an editorial product pursuant to Law No. 62/2001 and does not engage in real-time information activities.

The GoYou project does not provide professional, technical, legal, or financial advice and disclaims any liability for the misuse of the information published.

In the Crypto sector, every investment involves risks: readers are advised to always inform themselves independently before making any decisions.