New 'Firestarter' malware flames on in spite of Cisco firewall updates and security patches

Cybersecurity.

• Cisco Talos warns of Firestarter, a new malware targeting unpatched Firepower and Secure Firewall device
• UAT‑4356 group exploited flaws CVE‑2025‑20333 and CVE‑2025‑20362 to deploy Line Viper before dropping Firestarter
• CISA confirmed exploitation against at least one federal agency

Security researchers have warned of Firestarter, a brand new custom-built malware which targets unpatched Cisco Firepower and Secure Firewall devices, persisting over reboots, security patches, and even firmware updates.