New Cisco firewall malware can only be killed by pulling the plug

CISA and the UK NCSC warn that a state-linked group (UAT-4356) has used exploits for CVE-2025-20333 and CVE-2025-20362 to deploy a persistent backdoor called Firestarter on Cisco ASA/Firepower devices; Firestarter embeds into the device boot sequence and can be reactivated via a specially crafted WebVPN request, resists removal without a hard power cycle, and requires targeted hunting, core-dump collection, patching, and potentially reimaging to remediate.