CISA Alert: FIRESTARTER Rootkit Survives Patching on Cisco Firepower
Hey everyone, just caught the CISA release regarding the FIRESTARTER malware targeting a federal agency's Cisco Firepower setup. It’s concerning that the compromise dates back to September 2025, but what really stands out is the persistence mechanism. The assessment indicates this backdoor can survive standard security patches and upgrades.
It appears the threat actors are leveraging the underlying Linux environment (FXOS) rather than just the ASA logic itself. This suggests the implant is hooking into the boot process or residing in a persistent data partition that survives the ASA image re-deployment.
If you are managing these devices, I recommend checking for anomalous processes or hidden files on the management plane. Here is a quick snippet to help audit running processes that aren't signed or standard:
# Check for processes with no linked package or unusual paths
for pid in $(ps -eo pid | tail -n +2); do
cmd=$(readlink /proc/$pid/exe 2>/dev/null)
if [[ "$cmd" != *"/usr/local"* && "$cmd" != *"/bin"* && "$cmd" != *"/sbin"* && -n "$cmd" ]]; then
echo "PID: $pid | CMD: $cmd"
fi
done
Has anyone else encountered similar persistence mechanisms on edge appliances? Are we looking at a full factory reset requirement to trust these boxes again?
Good catch on the FXOS angle. We saw a similar TTP with a different APT last year targeting load balancers. They weren't just patching the OS; they were dropping a persistent cron job in the underlying Linux host. I'd also suggest checking last and wtmp logs for any logins that don't correlate with your change management tickets.
This is exactly why I hate 'smart' appliances. You patch the application logic, but the host OS remains vulnerable. The survival of the patch implies the malware is hooking the boot loader or potentially living in the BMC if present. In my lab, I'm now imaging the entire disk, not just upgrading the package, and verifying hashes against the vendor's golden master.
We don't run Firepower, but we do use a lot of ASA. This makes me nervous about the shared codebase. Does anyone know if the remote access capability allows for lateral movement directly from the firewall, or is it purely for C2 beaconing? If it touches the internal network interface, that changes the containment strategy significantly.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access