CISA and NCSC Warn of Firestarter Backdoor Found on Federal Agency Cisco Firewall, Linked to Chinese State Activity

Analysis
The hard-power-cycle-only removal requirement signals an objective beyond initial access: sustained collection or pre-positioning for infrastructure disruption. The mandatory physical disconnection directive imposes a rolling outage on federal civilian Cisco ASA deployments, a remediation cost that constitutes operational disruption in its own right. With Cisco ASA pervasive across federal network perimeters and the multi-agency campaign pattern established in Arcane Door's lineage, corroborated across converging U.S.-UK reporting, additional compromised federal networks are likely to surface within the next 90 days. The April 24 joint advisory's formal attribution to Chinese state-sponsored activity fills the gap left by initial disclosure's deliberate omission of the China link. Arcane Door may prove a third concurrent Chinese state-sponsored campaign distinct from Volt Typhoon and Salt Typhoon, meaning Beijing is running parallel penetration efforts against U.S. network perimeter infrastructure rather than a consolidated operation.