IC Technology & Surveillance — 2026-04-24

CISA and NCSC Disclose Persistent Firestarter Backdoor on Cisco Firewall Devices

CISA and the UK NCSC jointly published a malware analysis report on April 23 identifying a custom backdoor, code-named Firestarter, implanted on Cisco Firepower and Secure Firewall devices by a state-sponsored group tracked as UAT-4356 by Cisco Talos. According to CyberScoop, the backdoor survives firmware updates and standard reboots by manipulating the Cisco Service Platform mount list; only a hard power disconnect clears the persistence mechanism. CISA discovered the implant on a U.S. federal civilian agency device and issued an updated emergency directive requiring all federal civilian agencies to audit their Cisco firewall infrastructure and submit device memory snapshots by Friday. Censys researchers have previously linked the UAT-4356 group to China.

Analysis
The seven-month dwell time and the persistence engineering confirm an operational objective beyond initial access: sustained collection or pre-positioning for disruption, not a smash-and-grab. The emergency directive's physical power-disconnect requirement, absent from initial disclosures and confirmed across Cisco Talos, The Record, and CyberScoop, rules out software-only remediation and orders a rolling outage of federal civilian firewall infrastructure as the operational cost. Formal Five Eyes attribution to a named Chinese state actor is unlikely within the next six months. CISA's deliberate omission of the Censys-China link signals either an evidentiary gap or that the underlying intelligence is strong but compartmented, with attribution held for a separate joint advisory on a parallel track.

1 sources

UAT-4356 Targeting of Cisco Firepower Devices - Cisco Talos