FIRESTARTER Malware Targets Cisco ASA, Firepower, Secure Firewall
Summary
CISA published a malware analysis report on FIRESTARTER, malware that enables remote access and control by threat actors targeting Cisco Firepower and Secure Firewall products running Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD) software. CISA also issued new required actions for Federal Civilian Executive Branch (FCEB) agencies in Emergency Directive 25-03. CISA and NCSC-UK assess that an APT actor exploited CVE-2025-20333 and CVE-2025-20362 in Cisco ASA firmware to gain initial access and deploy FIRESTARTER. Threat actors continue to target these devices, and firmware patching alone may not remove an existing threat actor.
Organizations running Cisco ASA or FTD software should immediately review CISA's AR26-113a report and assess whether their devices are compromised — CISA's own analysis found that firmware patching did not remove an established threat actor, meaning a prior patch alone is not sufficient assurance of security.
About this source
GovPing monitors US CISA News for new data privacy & cybersecurity regulatory changes. Every update since tracking began is archived, classified, and available as free RSS or email alerts — 5 changes logged to date.
What changed
CISA published a malware analysis report on FIRESTARTER and updated Emergency Directive 25-03 with new required actions for FCEB agencies, including identifying specified Firepower and Secure Firewall devices, collecting forensic data, and applying new vendor-provided updates. The report, co-sealed with NCSC-UK, provides technical details on threat actor activity, FIRESTARTER's persistence mechanisms, and recommended detection methods and mitigations.
Organizations using Cisco Firepower and Secure Firewall products running ASA or FTD software should review the FIRESTARTER report, assess devices for compromise, implement recommended mitigations, and report any findings to CISA. CISA specifically notes that firmware patching on compromised devices does not necessarily remove an existing threat actor, making device-level forensic analysis essential.
What to do next
- Review the FIRESTARTER report
- Assess devices for compromise
- Implement mitigations
- Report any findings to CISA
Archived snapshot
Apr 23, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Press Release
CISA Warns of FIRESTARTER Malware Targeting Cisco ASA including Firepower and Secure Firewall Products
Agency Updates Emergency Directive 25-03 with New Actions to Identify and Mitigate Potential Compromise Released
April 23, 2026
Related topics: Cyber Threats and Response, Malware, Phishing, and Ransomware WASHINGTON – The Cybersecurity and Infrastructure Security Agency (CISA) published a malware analysis report today on FIRESTARTER, malware that allows remote access and control by malicious threat actors targeting Cisco Firepower and Secure Firewall products running Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD) software. In conjunction with this report, CISA issued new required actions for Federal Civilian Executive Branch (FCEB) agencies in Emergency Directive 25-03: Identify and Mitigate Potential Compromise of Cisco Devices. Threat actors continue to target these devices and products, posing significant risks to all organizations.
This malware analysis report, co-sealed with United Kingdom National Cyber Security Centre (NCSC-UK), provides organizations with the knowledge to help them detect and respond to FIRESTARTER. This report provides technical details on threat actor activity, FIRESTARTER’s secret to achieving persistence, as well as recommended detection methods, mitigations and actions for incident response. In this report, CISA and NCSC-UK assess that an advanced persistent threat (APT) actor exploited CVE-2025-20333 and CVE-2025-20362 in Cisco ASA firmware to gain initial access and deploy FIRESTARTER on Firepower and Secure Firewall devices.
“FIRESTARTER can persist as an active threat on Cisco ASA devices or FTD software. CISA encourages organizations using these devices or software to review the FIRESTARTER report, assess devices for compromise, implement mitigations, and report any findings to CISA,” said CISA Acting Director Nick Andersen. “Every day, CISA works with federal government and industry partners to assess cyber threats and publish actionable information for organizations to better protect themselves and ensure the integrity of their digital infrastructure.”
During proactive monitoring of Cisco ASA devices used by FCEB agencies, CISA detected FIRESTARTER malware that enabled post-patching persistence. CISA analysis determined that firmware patching actions on compromised devices did not necessarily remove an existing threat actor. CISA updates to ED 25-03 include identifying specified Firepower and Secure Firewall devices, collecting forensic data, and applying new vendor-provided updates.
As FCEB agencies implement the new ED 25-03 requirements, CISA will monitor compliance, provide technical assistance, and deliver additional resources as needed.
CISA urges network defenders using Cisco Firepower and Secure Firewall products running ASA or FTD software to review all applicable resources for this release and implement recommended actions.
For more information, please visit Cybersecurity Directives.
About CISA
As the nation’s cyber defense agency and national coordinator for critical infrastructure security, the Cybersecurity and Infrastructure Security Agency leads the national effort to manage, uncover, and reduce risk to our digital and physical infrastructure Americans rely on every hour of every day.
Visit CISA.gov for more information and follow us on X , Facebook , LinkedIn , Instagram .
Related Articles
Apr 10, 2024
Press Release
CISA Announces Malware Next-Gen Analysis
Aug 31, 2023
Press Release
U.S. and International Partners Release Report on Russian Cyber Actors Using “Infamous Chisel” Malware
Mar 13, 2023
Press Release
CISA Establishes Ransomware Vulnerability Warning Pilot Program
Dec 14, 2022
Press Release
Readout of Second Joint Ransomware Task Force Meeting
Mentioned entities
Related changes
Get daily alerts for US CISA News
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CISA.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when US CISA News publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.