Common Questions

Who is behind the FIRESTARTER Cisco firewall implant?: CISA and NCSC attribute FIRESTARTER to UAT-4356, the same government-backed actor responsible for the 2024 ArcaneDoor Cisco edge-device campaign. Cisco tracks the group as government-backed but declines to name a sponsoring state.Source: CISA/NCSC joint advisory AA26-113A
What is the difference between ArcaneDoor and FIRESTARTER?: ArcaneDoor (2024) used volatile-memory-resident code that a standard reboot could clear. FIRESTARTER hooks the device boot sequence and self-reinstalls during every reboot, surviving all patches; only a hard power-cut evicts it.Source: CISA/NCSC joint advisory AA26-113A
How does UAT-4356 activate the FIRESTARTER implant remotely?: UAT-4356 sends a magic-packet — a crafted WebVPN authentication request with a secret prefix byte — to the compromised Cisco appliance. This triggers shellcode in memory without producing a continuous outbound beacon that network telemetry would catch.Source: CISA/NCSC advisory AA26-113A
Which Cisco products are affected by UAT-4356 attacks?: Cisco ASA (Adaptive Security Appliance) and Firepower Threat Defense (FTD) appliances are the confirmed targets. CVE-2025-20333 and CVE-2025-20362, both patched September 2025, were the initial access vectors.Source: CISA/NCSC advisory AA26-113A

Background

UAT-4356 is the government-backed threat actor tracked by Cisco Talos that deployed the FIRESTARTER persistent implant on Cisco ASA and Firepower appliances, disclosed by CISA and NCSC in joint advisory AA26-113A on 24 April 2026. The actor chained CVE-2025-20333 (CVSS 9.9) and CVE-2025-20362 for initial access, both patched in September 2025. An unnamed US federal agency remained compromised for six months after applying those patches, the implant having re-embedded itself into the device boot sequence during each remediation reboot.

UAT-4356 is the same actor behind 2024's ArcaneDoor campaign, which also targeted Cisco edge devices but relied on volatile memory-resident code that a standard reboot could clear. FIRESTARTER represents a structural escalation: the implant hooks the device's pre-OS boot sequence, self-backs-up before clean shutdowns, and activates via a magic-packet primitive — a crafted WebVPN authentication request with a secret prefix byte — that produces no continuous outbound beacon for network telemetry to detect. The companion implant Line Viper rides VPN sessions and bypasses authentication policy entirely. Cisco accepts UAT-4356 is government-backed but declines to name a sponsoring state, the same hedged language used after ArcaneDoor.

UAT-4356 operates on a multi-year persistent access strategy. The escalation from ArcaneDoor's volatile-memory persistence to FIRESTARTER's boot-sequence hooks shows a deliberate capability investment timed to survive the patch cycles organisations adopted in response to 2024's disclosures.

UAT-4356 is a government-backed advanced persistent threat (APT) actor tracked by Cisco Talos. The group specialises in persistent-access operations against enterprise network edge devices, particularly Cisco ASA and Firepower appliances. First identified publicly via the 2024 ArcaneDoor campaign, UAT-4356 escalated its capability with the FIRESTARTER boot-sequence implant disclosed in April 2026. Neither CISA nor NCSC has formally attributed the actor to a named nation-state in published advisories.

Source Material

CISA Analysis Report AR26-113A: FIRESTARTER

How the World Sees Them

Cisco

Cisco accepts UAT-4356 is government-backed but publicly declines nation-state attribution, the same hedge used after ArcaneDoor, leaving enterprise customers to translate that into procurement risk.

United States

CISA confirmed one federal agency was compromised six months post-patch. The actor's government backing without named attribution limits OFAC sanctioning options under existing cyber frameworks.

China (denied)

No attribution to any Chinese actor has been made in published advisories. Cisco and allied agencies have not named a sponsoring state; characterisations of Chinese nexus remain speculative in open sources.

United Kingdom

NCSC co-signed the FIRESTARTER advisory under the same attribution authority it applied to APT28. UK operators under the CS&R Bill baseline cannot rely on patch records alone as a regulatory defence.