CISA: US agency breached through Cisco vulnerability, FIRESTARTER backdoor allowed access through March

CISA reported that a U.S. federal civilian agency was breached through Cisco ASA/Firepower vulnerabilities (CVE-2025-30333 and CVE-2025-20362). Attackers installed FIRESTARTER malware to retain persistence and used Line Viper to establish illegitimate VPN sessions that bypass authentication, exposing administrative credentials, certificates and private keys; CISA issued updated advisories and mandatory actions for federal agencies, requiring device inventories and forensic checks, and warned that patched devices may still be compromised.