In a separate advisory, Cisco’s Talos risk intelligence service mentioned a bunch it calls UAT-4356 is behind Firestarter, as a part of its continued focusing on of Firepower units. Different researchers name the group Storm-1849, and determine the marketing campaign focusing on networking units from Cisco and different distributors as ArcaneDoor, relationship again to 2023.
Vital failure in ‘patch and overlook’ mentality
CISA believes risk actors compromised Cisco firewalls by exploiting CVE-2025-20333 and/or CVE-2025-20362 early final September, earlier than patches to plug these holes have been launched.
Within the instance analyzed by the CISA, the hacker then deployed the LineViper shellcode loader to put in a VPN that the risk actor might use to entry all configuration components of the compromised Firepower gadget, together with administrative credentials and certificates and personal keys. Then the Firestarter backdoor was added and used to hyperlink to a command and management server, which allowed the backdoor to persist even after patching. All this occurred earlier than patches to the 2 vulnerabilities have been issued.
Firestarter achieves persistence by detecting termination indicators and relaunching itself, which is the way it can survive firmware updates and gadget reboots except a tough energy cycle happens.
“The Firestarter malware represents a vital failure within the ‘patch and overlook’ mentality of contemporary community safety,” mentioned IT analyst Rob Enderle of the Enderle Group.
“What makes this assault significantly uncommon is its technical resilience and anti-forensic capabilities,” he mentioned. “The malware registers callback capabilities for termination indicators like SIGTERM or SIGHUP, which permits it to mechanically relaunch if an admin tries to kill the method. It deep-dives into the LINA engine’s digital reminiscence to hook the C++ normal library, intercepting WebVPN requests to set off its payload. By utilizing ‘time stomping’ to masks its file presence and redirecting errors to /dev/null, it stays practically invisible to conventional discovery instruments.”
