CISA doesn’t issue Emergency Directives lightly. When ED 25-03 landed last week — mandating immediate action for federal agencies and urging all U.S. organizations to respond — it came with a warning that should stop every security leader cold:
Patching your Cisco ASA/FTD devices will not remove this threat.
FIRESTARTER is a persistent backdoor specifically engineered to survive firmware updates and device reboots. The nation-state APT behind it — UAT4356/Storm-1849, the same group responsible for the 2024 ArcaneDoor campaign — designed it to stay resident on your perimeter firewalls long after you think you’ve remediated. Once installed, it gives attackers persistent remote access and control of the most critical chokepoints in your network.
This is not a patch-and-move-on situation.
What Makes FIRESTARTER Different
Most vulnerabilities follow a predictable response arc: identify, patch, verify, close. FIRESTARTER breaks that arc at the last step.
Initial access was gained by chaining two zero-days — CVE-2025-20333 (a buffer overflow enabling remote code execution) and CVE-2025-20362 (a missing authorization flaw) — to fully take over vulnerable Cisco ASA and FTD devices. But the real danger isn’t the initial exploit. It’s what happens next.
Once FIRESTARTER is installed, it persists. Organizations that apply Cisco’s patches without first confirming the backdoor has been removed may believe they are clean while the attacker retains full access. Silently. Indefinitely.
And the target isn’t a workstation or a server. It’s your perimeter firewall — the device that controls everything entering and leaving your network.
The Pattern Every Security Leader Should Recognize
This is not the first time UAT4356 has done this. ArcaneDoor in 2024 targeted the same device category using different Cisco zero-days. Two years later, the same actor, the same target, a more sophisticated persistence mechanism.
Nation-state APTs are systematically targeting perimeter network infrastructure because these devices are high-value, under-monitored, and — when compromised — provide a persistent, trusted foothold for long-term espionage. FIRESTARTER won’t be the last campaign in this pattern.
The Questions You Need to Answer Right Now
If your organization runs Cisco ASA or FTD devices, five questions require immediate answers:
- Where are all my Cisco ASA/FTD devices — including cloud, branch, and remote deployments?
- Which are publicly accessible and therefore highest priority for investigation?
- If one is compromised, what can an attacker reach from it?
- Is my isolation actually enforced — or just intended?
- After patching, can I prove the threat is gone — not just hope the firmware update was enough?
How quickly you can answer these questions determines how effectively you respond. For organizations without continuous network visibility, each of these questions could take days to answer. Days you don’t have.
How RedSeal Helps
RedSeal customers aren’t starting from scratch when an advisory like this lands. They already have a continuously updated digital twin of their entire hybrid network — every Cisco device, every version, every connection, every potential attack path.
With RedSeal, you can immediately identify every affected device, understand the blast radius of a potential compromise, validate that isolation measures are actually working, deploy custom checks based on CISA’s indicators of compromise, and verify — with evidence — that your remediation closed the door.
Not as a one-time audit. Continuously.
That’s the difference between reacting to FIRESTARTER and being prepared for whatever comes next.
Don’t Wait for the Next Directive
CISA issued this emergency directive because the threat is real and active right now. If you’re not sure how exposed you are — or you’re not confident your response is complete — let’s talk.
RedSeal can show you exactly what’s at risk in your environment and help you respond with confidence.
