UAT-4356's Targeting of Cisco Firepower Devices
Summary: Cisco Talos reports that UAT-4356, the actor it attributed to the state-sponsored ArcaneDoor campaign in early 2024, is actively targeting Cisco Firepower devices running FXOS and exploited n-day vulnerabilities CVE-2025-20333 and CVE-2025-20362 to deploy a custom backdoor called FIRESTARTER. FIRESTARTER injects into the LINA process to execute arbitrary shellcode from WebVPN request XML, and establishes persistence by manipulating the CSP_MOUNT_LIST so it triggers on graceful reboot, writing itself to /opt/cisco/platform/logs/var/log/svc_samcore.log and /usr/bin/lina_cs.
Why it matters: The implant's persistence only survives a graceful reboot, so a hard reboot after unplugging the device removes it - but that same design means routine reboots and maintenance windows can quietly re-arm an intrusion on perimeter devices a state-sponsored actor is using for espionage.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-20333CVE-2025-20362
- Related