A Chinese Backdoor Hid in a Federal Firewall for Months

CISA and the UK's NCSC disclosed FIRESTARTER, a backdoor that survived patches and reboots on a federal agency's Cisco Firepower device. The fix? Physically unplug it.

State of Surveillance Editorial Team

Close-up of network cables and blinking lights on server rack equipment in a data center
Photo via Unsplash

TL;DR: On April 23, 2026, CISA and the UK's National Cyber Security Centre disclosed FIRESTARTER, a backdoor planted by suspected Chinese state-sponsored hackers on a U.S. federal agency's Cisco Firepower firewall. The malware was deployed in September 2025 by exploiting two vulnerabilities (CVE-2025-20333 and CVE-2025-20362). Here's the scary part: the backdoor survived Cisco's software patches, firmware updates, and normal reboots. It rewrote the device's boot sequence to relaunch itself every time. The only way to kill it was to physically pull the power cord from the wall. Six months after the initial compromise, the attackers came back through the same backdoor and deployed a second tool called LINE VIPER that bypassed all VPN authentication. Every affected device's credentials, certificates, and private keys should be considered compromised. CISA has given all federal civilian agencies until April 30 to hard-reset their Cisco firewalls: the same deadline as FISA 702.

What CISA Found

Sometime in September 2025, hackers from a group tracked as UAT4356 (also called Storm-1849) exploited two vulnerabilities in Cisco's Adaptive Security Appliance software running on a Firepower device at an unnamed Federal Civilian Executive Branch agency [1].

The first vulnerability, CVE-2025-20333, scored a 9.9 out of 10 on the severity scale. It let anyone with valid VPN credentials execute arbitrary code as root, the highest level of system access. The second, CVE-2025-20362, allowed unauthenticated attackers to access restricted URL endpoints through crafted HTTP requests [2].

Once inside, they planted FIRESTARTER, a Linux binary designed specifically to run on Cisco Firepower and Secure Firewall hardware. CISA's malware analysis report describes it as a persistence mechanism that "attempts to install a hook within LINA, the device's core engine for network processing and security functions" [3].

Translation: they didn't just break in. They rewired the firewall's brain.

Why Patching Didn't Help

Here's where this gets worse. Cisco issued patches for both vulnerabilities. CISA ordered federal agencies to apply them. Many did. It didn't matter.

FIRESTARTER achieves persistence by manipulating the Cisco Service Platform (CSP) mount list, the boot sequence that tells the device what to load at startup. According to CISA, the malware "copies itself to a secondary location and rewrites the mount list to restore and relaunch itself" after every reboot [4]. Standard firmware updates don't touch the mount list. Neither do normal reboots.

As CISA put it: "Devices compromised prior to patching may remain vulnerable because FIRESTARTER is not removed by firmware updates" [2].

The only reliable way to eliminate the backdoor is a hard power-down. Not a reboot command. Not a firmware reinstall. You have to physically pull the power cord out of the back of the device and plug it back in. Cisco's own advisory states "the power cord must be pulled out and plugged back in the device" [2].

For a device that protects an entire federal network, that's an extraordinary sentence.

They Came Back Six Months Later

In March 2026 (six months after the initial breach) the same threat actors returned through FIRESTARTER and deployed a second tool called LINE VIPER [1].

LINE VIPER is the payload FIRESTARTER was designed to deliver. According to The Record, it "established illegitimate virtual private network sessions that bypassed all VPN authentication policies" [5]. It could execute commands on the device's command-line interface, capture network traffic, suppress syslog messages (to cover its tracks), and harvest credentials from legitimate users logging in.

The attackers used a "magic packet" (a specially crafted WebVPN authentication request) to trigger FIRESTARTER and deploy LINE VIPER remotely. No need to re-exploit the original vulnerabilities. The backdoor was already waiting [2].

CISA's assessment: all configuration elements of a compromised device "should be considered untrusted." That means every credential, certificate, and private key stored on or transmitted through the firewall needs to be rotated [2].

The Arcane Door Campaign

UAT4356 isn't new. The group is linked to a campaign called ArcaneDoor, first disclosed by Cisco's Talos team in May 2024, which targeted perimeter network devices at government organizations worldwide [6].

FIRESTARTER shares "significant technical similarities with a previously documented implant called RayInitiator", an ArcaneDoor bootkit [4]. Cisco assessed "with high confidence that the campaign is tied to the same hackers behind the ArcaneDoor campaign" [5].

Neither CISA nor Cisco has officially attributed ArcaneDoor to a specific country. But in 2024, internet intelligence firm Censys found "compelling evidence indicating a threat group based in China," including infrastructure hosted on "multiple major Chinese networks and Chinese-developed anti-censorship software" [4]. CyberScoop reported sources describing alignment with "China's state interests" [5].

The pattern fits. Chinese state-backed groups (including Salt Typhoon, which compromised FBI surveillance systems earlier this year) have systematically targeted the edge devices (firewalls, VPN concentrators, routers) that sit between government networks and the internet.

How Big Is This?

CISA says only one Federal Civilian Executive Branch agency is confirmed compromised. But the agency also says FIRESTARTER is "part of a widespread campaign" and "it is suspected of being part of a wider campaign targeting government and critical national infrastructure networks" [1].

The affected device types include Cisco Firepower 1000, 2100, 4100, and 9300 series, plus Secure Firewall 200, 1200, 3100, 4200, and 6100 series [3]. That covers a significant portion of the federal firewall fleet.

CISA's updated Emergency Directive (ED 25-03) requires all federal civilian agencies to:

  • Upload core dump files from their Cisco devices for CISA analysis (deadline: April 24, 2026)
  • Apply all Cisco-provided patches (deadline: April 24, 2026)
  • Perform hard power resets, physically unplugging devices (deadline: April 30, 2026)

The UK's NCSC issued a parallel advisory the same day [4].

The Firewalls Guarding Federal Networks Are the Target

This is the second time in 2026 that foreign hackers have been caught living inside U.S. government security infrastructure. In February, the FBI disclosed that Chinese hackers from the Salt Typhoon group had breached its own surveillance systems, the FISMA-classified systems that handle wiretap data and legal process returns [7].

Now we know state-sponsored hackers were also sitting inside a federal firewall for at least six months, with the ability to intercept network traffic, bypass VPN authentication, and steal credentials. The very device meant to keep attackers out had been turned into their front door. It echoes the breach of the FBI's wiretap and surveillance systems uncovered the same year.

The irony isn't subtle. While Congress debates whether to extend the government's authority to conduct warrantless surveillance under Section 702, the government can't keep foreign intelligence services out of its own surveillance infrastructure. The April 30 deadline for physically resetting compromised firewalls falls on the same day Section 702 is set to expire.

What You Can Do

If you're a network administrator running Cisco Firepower or Secure Firewall devices:

  • Check CISA's advisory: ED 25-03 applies to federal agencies, but any organization running affected Cisco hardware should follow the same guidance [3]
  • Don't trust a reboot: A software reboot or firmware update will not remove FIRESTARTER. You must physically disconnect and reconnect power
  • Rotate everything: Assume all credentials, certificates, and VPN keys on the device are compromised. Replace them
  • Check core dumps: Upload device memory snapshots to CISA for analysis if you suspect compromise
  • Monitor for magic packets: FIRESTARTER triggers on specially crafted WebVPN authentication requests. Audit your VPN logs for anomalous authentication patterns

For everyone else: the lesson here is that "we patched it" doesn't mean "it's fixed." Government agencies applied Cisco's security updates and believed their networks were clean. The hackers were still inside. In cybersecurity, patching is necessary but not sufficient, especially when state-sponsored actors are targeting the devices that guard the perimeter.

References

  1. The Record: "CISA: US agency breached through Cisco vulnerability, FIRESTARTER backdoor allowed access through March"
  2. The Hacker News: "FIRESTARTER Backdoor Hit Federal Cisco Firepower Device, Survives Security Patches"
  3. CISA: "FIRESTARTER Backdoor" Malware Analysis Report AR26-113A
  4. CyberScoop: "US, UK agencies warn hackers were hiding on Cisco firewalls long after patches were applied"
  5. SecurityWeek: "US Federal Agency's Cisco Firewall Infected With 'Firestarter' Backdoor"
  6. CISA: "V1: ED 25-03: Identify and Mitigate Potential Compromise of Cisco Devices"
  7. The Hill: "FBI labels data breach 'major incident,' notifies Congress"

Published: April 27, 2026