30APR

Federal agency stayed compromised six months

3 min read

08:16UTC

An unnamed US federal agency was confirmed still hosting FIRESTARTER in March 2026, six months after applying the September 2025 Cisco patches.

← Back to FIRESTARTER puts Cisco below the patch line Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Six months of dwell after a clean patch shifts the lever from SLA compliance to forensic audit.

CISA disclosed alongside the FIRESTARTER advisory that an unnamed US federal agency was confirmed still hosting the implant in March, six months after the September patch cycle that should have closed the file⁠¹. The agency had applied those patches on schedule and the implant rode through. CISA has not released the agency's identity.

The operational read of the implant's design explains the dwell. UAT-4356's FIRESTARTER writes itself back to disk before clean shutdowns, so a routine patch reboot reinstates the backdoor rather than removing it. There is no continuous outbound beacon to flag in network telemetry; activation runs through magic-packet primitives that look like ordinary WebVPN traffic until the secret prefix arrives. NCSC and CISA are, in effect, telling operators that the September patch cycle is not a closure event but a starting line for memory analysis and device-side anomaly detection.

BRICKSTORM sets the precedent that frames this dwell. Mandiant disclosed BRICKSTORM at much longer residency than the FIRESTARTER federal case, which signals that nation-state actors are confident they will be undetected long enough to amortise the implant cost across multiple operational objectives. The implication for any CISO with Cisco ASA or FTD at the edge is a procurement audit on attestation and immutable-boot product categories, plus a board-level conversation about disclosure exposure when 'patched' and 'clean' have decoupled.

Deep Analysis

In plain English

A US government agency followed all the official advice: it applied the security patches, ticked every compliance box, and signed off the firewall as clean. Months later it turned out the firewall still contained a hidden back door that the patch had simply left untouched. This happened because the patch fixes software; the back door had hidden itself below the level software controls, in the code that runs before any software starts. Compliance paperwork and real-world cleanliness had silently separated.

Deep Analysis

Root Causes

Standard enterprise patch management operates on a compliance model: apply the patch, record the completion, close the ticket. This model assumes that applying a patch to a device is equivalent to removing a prior compromise, which is structurally false for boot-sequence implants that restore themselves before the OS loads.

The unnamed federal agency's six-month dwell also exposes a monitoring gap specific to network-edge devices. Most SOC tooling is designed for endpoint and cloud workload telemetry; firewall appliances are monitored primarily via syslog and SNMP for availability, not for sub-OS anomaly detection.

FIRESTARTER produced no continuous beacon and activated only on the specific magic-packet trigger, which means no traffic anomaly appeared in the monitoring layer until CISA's external detection process identified the device.

What could happen next?

Consequence
Federal contractor and critical infrastructure operators subject to FISMA or NIS2-equivalent frameworks face a disclosure question: 'patched and compliant' is no longer a sufficient answer to board-level incident materiality review.
Immediate · 0.85
Risk
SOC tooling vendors face pressure to add device-level boot-sequence anomaly detection as a default capability; current SIEM and EDR products have no visibility below the OS layer on firewall appliances.
Short term · 0.8
Precedent
CISA's decision to disclose a specific federal dwell figure sets a new bar for government transparency on active compromises; prior practice was to confirm breaches without releasing forensic detail.
Medium term · 0.75

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2020 SolarWinds SUNBURST campaign saw malicious code distributed inside a trusted software update to approximately 18,000 federal and private-sector customers; CISA issued emergency directive ED20-04 requiring all agencies to power down affected systems.

SUNBURST dwell inside some federal agencies ran from March to December 2020, a nine-month window, also on a device class where patching was the assumed closure event. The structural parallel is exact: a trusted update mechanism delivering persistence, a federal agency following standard procedures, and a dwell that only closed when detection was triggered by external evidence rather than internal telemetry.

Counter-parallel: The 2016 Bangladesh Bank SWIFT heist relied on persistent access maintained for months inside the bank's network, but that case involved criminal financial motivation and was discovered when fraudulent transfer instructions activated the implant into operational mode. FIRESTARTER's magic-packet activation suggests a collection capability rather than a disruption-ready one, which implies the actor is choosing not to activate rather than being unable to do so.

Consensus view: CISA's disclosure of the six-month federal dwell reframes the enterprise security operations centre (SOC) investment question. Carnegie Endowment for International Peace's Cyber Policy Initiative argues that the persistent-implant class of attacks has already invalidated patch SLA as the primary board-level accountability metric; the federal dwell figure provides the first public data point confirming a real-world failure case in a government-tier environment.

Counter-view: Mandiant's M-Trends reporting on mean dwell time shows that the median attacker in corporate environments persists for around 10 days before detection.

From that baseline, a six-month dwell on a patched federal firewall looks exceptional but not structurally novel: prolonged government-sector dwell was also documented in the SolarWinds Orion compromise, where some federal agencies hosted SUNBURST for nine months. The six-month figure reflects detection investment choices, not a fundamentally new attacker capability.

Key tension: Whether the six-month dwell indicates a systemic gap in US federal agency device-level monitoring, or whether it reflects a specific choice by UAT-4356 to remain dormant and avoid triggering detection tooling during the window of highest scrutiny immediately after the patch.

Sources:CISA

Mentions:FIRESTARTER →UAT-4356 →CVE-2023-50224 →CISA →Orion →NCSC →Cisco →WebVPN →Mandiant →Bangladesh →SolarWinds →BRICKSTORM →Carnegie Endowment for International Peace →Aker ASA →SOC →M-Trends 2026 →Cisco ASA →

First Reported In

Update #2 · FIRESTARTER puts Cisco below the patch line

CISA· 30 Apr 2026

Read original →

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.