New 'Firestarter' Malware Flames on in Spite of Cisco Firewall Updates and Security Patches

New 'Firestarter' malware flames on in spite of Cisco firewall updates and security patches

Security pros are warning about custom malware targeting Cisco firewalls, and surviving upgrades and reboots.

US, UK authorities warn that Firestarter backdoor malware survives patching

A federal agency was impacted by a hacking campaign that exploited flaws in Cisco devices.

Infected Cisco firewalls need cold start to clear persistent Firestarter backdoor

Security researchers have discovered a chilling backdoor aimed at Cisco System firewalls that exploits unpatched vulnerabilities to maintain persistence, even after patching. This means that attackers can continue to access compromised devices without re-exploiting the holes. At risk are devices running Cisco ASA or Firepower software, including certain Firepower and Secure Firewall devices. So far, however, the US Cybersecurity and Infrastructu…

‘Firestarter’ malware survives Cisco firewall patches

Cisco has confirmed that the ArcaneDoor threat actor deployed a persistence mechanism that isn’t handled by the security patches released by the company in September last year, affecting the operating system in a range of Firepower and Secure Firewall protective devices. Named Firestarter by the United States Cybersecurity and Infrastructure Security Agency (CISA) and Britain’s National Cyber Security Centre (NCSC), the malware implant is a Lin…

'Firestarter' malware survives Cisco firewall patches

Pull mains plug on firewalls to kill the malware, CISA advises.