Firestarter Malware Sparks Updated CISA Emergency Directive

Threat actors are using a backdoor called Firestarter to establish persistence in attacks against Cisco devices. In response, CISA issued a malware analysis and an updated emergency directive for federal agencies to identify and mitigate potentially targeted Cisco devices.

The malware is used specifically in attacks against Cisco Firepower and Secure Firewall products running Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD) software. It was found as part of a wave of existing attacks on two previously known and identified Cisco vulnerabilities, CVE-2025-20333 (which allows for remote code execution) and CVE-2025-20362 (which enables privilege escalation). When the flaws were first disclosed in September 2025, Cisco Talos researchers outlined a widespread APT campaign exploiting the bugs in order to modify compromised devices’ ROM and maintain persistence. 

While CISA initially issued an ensuing emergency directive for the activity on September 25, 2025, the agency updated the directive on April 23 after the discovery of Firestarter, which allows remote access and control, and has been used as a persistence mechanism to maintain continued access to the compromised device. 

CISA’s advisory stressed that, though Cisco’s patches addressed CVE-2025-20333 and CVE-2025-20362, devices that were compromised prior to patching may still remain vulnerable because Firestarter is not removed by firmware updates.

“Firestarter as an active threat on Cisco ASA devices or FTD software," said CISA Acting Director Nick Andersen in a statement last week. "CISA encourages organizations using these devices or software to review the Firestarter, assess devices for compromise, implement mitigations, and report any findings to CISA."

How CISA Found Firestarter

CISA first found Firestarter while looking into suspicious connections on a U.S. Federal Civilian Executive Branch (FCEB) agency’s Cisco Firepower device running ASA software. CISA said that APT actors likely accessed devices by exploiting the Cisco flaws in early September 2025, before the agency implemented patches.

After initial access, threat actors deployed Line Viper as an implant. Line Viper is a known, modular in-memory backdoor loader. In this incident, the actors also used it to establish VPN sessions that bypassed VPN authentication policies, specifically for user accounts that existed but were no longer active within the agency. Line Viper also gave APT actors access to all configuration elements of the targeted Firepower devices, like admin credentials, certificates, and private keys. They then used the implant to deploy Firestarter as a persistence mechanism.

“APT actors deployed Firestarter on the Firepower device before Sept. 25, 2025 (exact date is unknown),” according to CISA’s analysis. “Because it was present before patching, Firestarter persisted through remediation and established command and control (C2) channels on the victim Firepower device."

Then, APT actors leveraged Firestarter to regain access without having to re-exploit the original vulnerabilities, and deployed Line Viper in March.

What is Firestarter Malware?

According to CISA, Firestarter is a Linux Executable and Linkable File that’s specifically designed to execute on Cisco Firepower and Secure Firewall devices and then serve as a C2 channel for remote access and control. 

“The malware achieves persistence by detecting termination signals and relaunching itself, and it can survive firmware updates and device reboots unless a hard power cycle occurs,” according to CISA. “Firestarter attempts to install a hook—a way to intercept and modify normal operations—within LINA, the device’s core engine for network processing and security functions. This hook enables the execution of arbitrary shell code provided by the APT actors, including the deployment of Line Viper.”

CISA’s malware analysis has provided more in-depth details about Firestarter, including its initialization, functionality, shellcode injection, and YARA rules. The primary detection method for this malware is memory analysis; upon execution, Firestarter accesses its own binary located at /usr/bin/lina_cs on the device and copies its contents into memory.

As such, under CISA’s emergency directive all U.S. FCEB agencies are required to collect device core dumps and submit them to CISA’s Malware Next Generation platform. This platform analyzes core dumps for the presence and behavior of the lina_cs binary.

CISA’s Executive Order 

CISA’s updated executive order still has many of the same requirements as the original, including identifying all Cisco ASA platforms and submitting a code dump via the Malware Next Gen portal for those Cisco ASA hardware appliances.

However, it added more steps:

-For public-facing Cisco Firepower and Secure Firewall devices, immediately identify all Firepower 1000, 2100, 4100, 9300 series and Secure Firewall 200, 1200, 3100, 4200, and 6100 series devices. 

-For all identified devices, follow CISA’s step-by-step Core Dump and Hunt Instructions and submit core dump(s) via the Malware Next Gen portal by Friday.

-By May 1, 2026, report a complete inventory of all Firepower 1000, 2100, 4100, 9300 series and Secure Firewall 200, 1200, 3100, 4200, and 6100 series devices to CISA including details on actions taken and results.

For all other U.S. organizations, CISA recommends reviewing its supplemental directive and generating a code dump from impacted Cisco devices, before deploying the provided YARA rules. For compromised devices, organizations should unplug the device from all power sources, as CISA said this is the only method to remove Firestarter’s persistence from a device.  

Then, they should locate the physical device and unplug it from its power source while the device is still powered on, leave the device disconnected from a power source for one minute, reconnect the device to its power source to allow it to reboot, and report the malware to CISA.