Firestarter Backdoor Survives Cisco Patch Cycles on Firepower Gear
U.S. CISA and U.K. NCSC warn that Firestarter malware persists on Cisco Firepower/ASA/FTD devices after patches, maintaining persistence by hooking into the LINA process and re‑launching after reboots or firmware updates; attackers used Line Viper to gain initial access before deploying Firestarter. Cisco provides mitigations and recommends reimaging, with cold restart as a last resort (risking disk damage); CISA has released YARA rules to aid detection.
