FIRESTARTER

2026-05-134 minCisco Taloshigh

Cisco Talos' Q1 2026 incident response trends highlight a resurgence in phishing as the primary initial access vector, augmented by AI tools like Softr for rapid credential harvesting. Threat actors are increasingly abusing legitimate tools such as TruffleHog to discover exposed secrets, while specific campaigns like UAT-4356 have been observed exploiting n-day vulnerabilities to deploy custom backdoors on network devices.

2026-05-135 minCISAcritical

CISA and NCSC identified FIRESTARTER, a persistent Linux ELF backdoor deployed by APT actors on Cisco Firepower and Secure Firewall devices. The malware hooks into the LINA engine, survives firmware updates and soft reboots, and facilitates the deployment of secondary payloads like LINE VIPER to establish unauthorized VPN sessions.