Persistent Firestarter Malware Targets Cisco Firepower Devices in US Agencies

Firestarter, a sophisticated persistent backdoor attributed to state-sponsored actor UAT-4356, has been discovered on Cisco Firepower devices exploiting CVE-2025-20333 and CVE-2025-20362; CISA confirmed infection of a U.S. federal agency device and issued an emergency audit directive. The malware can execute arbitrary code and survive firmware updates and reboots by manipulating the Cisco Service Platform mount list, posing a high risk to government and critical infrastructure networks.