A joint advisory from CISA and the UK's National Cyber Security Centre dropped overnight with a finding that should keep network defenders up at night: a custom backdoor called FIRESTARTER was planted on a US federal civilian agency's Cisco Firepower device running ASA software back in September 2025 — and it kept working even after security patches were applied.

That last part is the headline within the headline. Patching is the bedrock assumption of most incident response playbooks. You find the vulnerability, you patch it, you move on. FIRESTARTER is specifically designed to survive that process. Once it's in, it maintains persistent remote access and control of the infected device, meaning a successful patch doesn't evict the attacker — it just closes the door they used to get in the first time.

What we know about the malware. FIRESTARTER is a purpose-built backdoor, not an off-the-shelf tool. It targets Cisco Firepower devices running either Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD) software — network security gear that sits at the edge of enterprise and government networks. Compromising a firewall isn't just compromising a device; it's compromising the entity that decides what traffic is legitimate. An attacker with control of your firewall can see everything, redirect traffic, and stay invisible while doing it.

CISA and the NCSC haven't publicly attributed the attack to a specific threat actor, but the choice of target — a federal civilian agency — and the sophistication of an implant engineered for post-patch persistence are markers consistent with nation-state tradecraft.

Why this matters beyond the affected agency. The advisory explicitly flags that other Cisco Firepower and ASA deployments should be treated as potentially at risk. That's a lot of infrastructure. Cisco's firewall products are among the most widely deployed in the world, particularly in government and critical infrastructure environments. If FIRESTARTER is being used broadly (and there's reason to think this wasn't a one-off), defenders running these devices need to assume that patching alone isn't sufficient remediation.

The implication is uncomfortable: if your device was compromised before you patched, you may still be compromised after. A clean bill of health from a patch scan and a fully compromised network can coexist.

What defenders should do now. Both agencies recommend going beyond standard patch verification. That means checking for unexpected processes, unusual outbound connections, and configuration changes that predate known compromise windows. Forensic analysis of device firmware and persistent storage — not just the operating environment — is the right call here. CISA has published indicators of compromise in the advisory.

Watch for. Attribution is the obvious next shoe to drop. The sophistication of this implant and the choice of a federal target narrows the field considerably. Also worth watching: whether FIRESTARTER turns up on non-government Cisco deployments in the coming weeks. If it does, this advisory will look like the quiet opening of a much larger conversation.