John Z Black

John Z Black Apr 23, 2026 Security Operations & Resilience #cisco #firestarter #persistence #malware #cisa #federal #incident-response #patch-management

A lot of us treat patching like a finish line. You apply the fix, you check the box, and you move on. But a U.S. federal agency just learned that this logic is dangerously flawed.

They patched their Cisco ASA/Firepower devices according to the latest advisories. They thought the incident was over. But it wasn’t. They were infected with a backdoor called FIRESTARTER that didn’t care about the patch. The implant survived the entire remediation cycle, giving the attackers a permanent seat in the network even after the original “door” was locked.

This is a wake-up call for incident responders. FIRESTARTER isn’t just malware; it’s a persistence mechanism built specifically to outlast your response. It waits quietly, independent of the original vulnerability. CISA had to bring in a specialized forensic team just to find it.

If any of your Cisco gear was vulnerable recently, you can’t just patch and pray. You need to hunt for specific files like lina_cs and svc_samcore.log. And here is the kicker: a standard soft reboot won’t kill it. You have to physically pull the plug—a hard power cycle—or completely reimage the device to be sure it’s gone.

Stop assuming the patch cleared the attacker. Changing the locks on the front door doesn’t help if the burglar is already hiding in the crawlspace.

See why standard remediation isn’t enough for FIRESTARTER and get the post-patch checklist you actually need.