CISA 2026-04-23

FIRESTARTER Backdoor

Machine-generated analysis · WAYSCloud LLM

FIRESTARTER is a backdoor targeting Cisco ASA and FTD software on publicly accessible firewall devices. The advisory indicates confirmed successful implants on Cisco Firepower devices running ASA.

Context

The affected products are Cisco Firepower and Secure Firewall devices running Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD) software. The advisory states APT actors are using FIRESTARTER malware for persistence on these devices. The analysis is based on a sample from a forensic investigation and aligns with emergency directives for Cisco device compromise.

Operator considerations

Check: Inventory publicly accessible Cisco Firepower and Secure Firewall devices running ASA or FTD software.
Isolate: Restrict public access to Cisco firewall management interfaces if not required.
Log: Monitor core dump files and device logs for signs of FIRESTARTER using provided YARA rules.

From Cybersecurity and Infrastructure Security Agency ↗

Malware Analysis Report at a Glance

Malware Name

FIRESTARTER

Original Publication

April 23, 2026

Executive Summary

The Cybersecurity and Infrastructure Security Agency (CISA) analyzed a sample of FIRESTARTER malware obtained from a forensic investigation. CISA and the United Kingdom National Cyber Security Centre (NCSC) assess advanced persistent threat (APT) actors are using FIRESTARTER malware for persistence, specifically targeting publicly accessible Cisco Firepower and Secure Firewall devices running Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD) software. CISA and the NCSC are releasing this Malware Analysis Report to share analysis of one FIRESTARTER malware sample operating as a backdoor and urge organizations to take key response actions.

Note: The release of this Malware Analysis Report aligns with CISA’s update to V1: Emergency Directive (ED) 25-...

Read the full advisory on CISA →