US-UK Alert on Firestarter Malware in Cisco Devices

Cybersecurity agencies from the United States and United Kingdom issued a joint alert on Thursday warning of a persistent backdoor malware known as Firestarter infecting Cisco Firepower and Secure Firewall devices running Adaptive Security Appliance or Firepower Threat Defense software. The implant, attributed to a threat actor tracked by Cisco as UAT4356, has been linked to cyberespionage operations and enabled unauthorized access to at least one U.S. federal civilian executive branch agency as recently as March 2026.

The compromise began in early September 2025, when attackers exploited two now-patched vulnerabilities in the devices' VPN web server: CVE-2025-20333, a missing authorization flaw, and CVE-2025-20362, a buffer overflow vulnerability. Cisco released fixes for these issues in late September 2025, following an initial alert from the U.S. Cybersecurity and Infrastructure Security Agency, or CISA, via Emergency Directive 25-03. However, devices infected prior to patching retained the malware, which evades removal through standard firmware updates or software reboots.

In the observed federal incident, CISA detected suspicious network connections during continuous...