⚠️ CRITICAL: FIRESTARTER Backdoor

[threatnoir@infosec.exchange]

️ CRITICAL: FIRESTARTER Backdoor

APT actors deployed FIRESTARTER, a persistent Linux backdoor on Cisco Firepower and Secure Firewall devices via CVE-2025-20333 and CVE-2025-20362. The malware survives firmware patches and works with LINE VIPER to maintain remote access. Any organization running these devices is at risk of undetect…

Urgent Threats & Advisories | ThreatNoir

Active and archived urgent security threats, CVEs, and advisories for SOC teams and threat hunters.

(threatnoir.com)

#infosec #cybersecurity