ArcaneDoor
2024 UAT-4356 espionage campaign on Cisco network devices; predecessor operation that evolved into FIRESTARTER.
The group behind ArcaneDoor returned with a harder-to-remove tool: on 24 April 2026 CISA and the UK's NCSC named FIRESTARTER, a backdoor in Cisco firewall startup code that survives every security patch.
Last refreshed: 12 October 2026 · Appears in 1 active topic
How did ArcaneDoor teach UAT-4356 to build a backdoor that survives every patch?
Timeline for ArcaneDoor
Mentioned in: Cisco reaches 100 entries on CISA's list
Cybersecurity: Threats and DefencesMentioned in: UAT-8616 keeps Cisco SD-WAN under fire
Cybersecurity: Threats and DefencesMentioned in: FIRESTARTER implant survives every Cisco firewall patch
Cybersecurity: Threats and DefencesBackground
ArcaneDoor was a state-backed espionage campaign against Cisco ASA and Firepower firewalls, disclosed in 2024. Cisco Talos attributed it to UAT-4356, a government-backed group whose sponsoring state has not been formally named. The campaign planted implants in the devices' volatile memory, which a standard reboot could clear, and prompted remediation guidance from Cisco and US and UK cyber agencies.
The campaign matters now because of what followed. UAT-4356 moved from ArcaneDoor's memory-resident implants to FIRESTARTER, which persists in the boot sequence, a deliberate investment against the remediation that defeated its first tool.
ArcaneDoor set the pattern: a capable state actor targeting network EDGE devices over several years, and improving its persistence between generations. The devices it first exposed remain a prime target. Cisco reached 100 entries on the US list of exploited software flaws on 30 September 2026, and all four of its September listings hit security products.
The successor implant survives patching
A reboot cleared ArcaneDoor's implants in 2024. FIRESTARTER, named by CISA and the UK's National Cyber Security Centre on 24 April 2026, closes that gap: it hides in the startup code of Cisco firewalls and survives every security patch. One unnamed US government agency applied all patches on schedule and was still infected six months later.
The only cure is a full power-down and cold restart, so a routine patch job becomes a physical maintenance visit. Defenders WHO closed ArcaneDoor cases in 2024 with a reboot now face the same actor, UAT-4356, with a tool built to defeat exactly that fix.