--- title: CISA, NCSC issue Firestarter backdoor warning | daily.dev description: CISA and the UK's NCSC have issued a joint advisory warning about a previously unknown backdoor malware called Firestarter, which was found on a US Federal... canonical: https://daily.dev/posts/cisa-ncsc-issue-firestarter-backdoor-warning-bhwqesv4m twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CISA, NCSC issue Firestarter backdoor warning | daily.dev og:description: CISA and the UK's NCSC have issued a joint advisory warning about a previously unknown backdoor malware called Firestarter, which was found on a US Federal... og:url: https://daily.dev/posts/cisa-ncsc-issue-firestarter-backdoor-warning-bhwqesv4m og:image: https://api.daily.dev/og/posts/bHwqesV4M.png og:image:alt: CISA, NCSC issue Firestarter backdoor warning og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CISA, NCSC issue Firestarter backdoor warning **[The Register](https://daily.dev/sources/theregister)** · 3 min read · 0 upvotes · 0 comments ## Summary CISA and the UK's NCSC have issued a joint advisory warning about a previously unknown backdoor malware called Firestarter, which was found on a US Federal Civilian Executive Branch agency's network. The malware targets Cisco Secure Firewall ASA and FTD products and is notable for maintaining persistent access even after device updates. The attack is suspected to be part of a broader campaign against government and critical national infrastructure. Cisco attributes the activity to threat group UAT-4356, believed to be government-backed but not formally attributed to any nation-state. All US and UK organizations are advised to take preventative measures, including using YARA rules for memory analysis. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [CISA warns federal agencies to patch flawed Cisco firewalls amid ‘active exploitation’ across the US government](https://daily.dev/posts/cisa-warns-federal-agencies-to-patch-flawed-cisco-firewalls-amid-active-exploitation-across-the-us-0rzkwm33k) · TechCrunch · 0 upvotes · 0 comments - [Cisco faces Senate scrutiny over firewall flaws](https://daily.dev/posts/cisco-faces-senate-scrutiny-over-firewall-flaws-zegrtexnn) · The Register · 0 upvotes · 0 comments - [Response to CISA Advisory \(AA25-343A\): Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure](https://daily.dev/posts/response-to-cisa-advisory-aa25-343a-pro-russia-hacktivists-conduct-opportunistic-attacks-against--etypghjmt) · Security Boulevard · 0 upvotes · 0 comments - [Cisco warns of ASA and FTD VPN flaw exploited to crash devices](https://daily.dev/posts/cisco-warns-of-asa-and-ftd-vpn-flaw-exploited-to-crash-devices-awbvdguob) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#cisco](https://daily.dev/tags/cisco) [View this post on daily.dev](https://daily.dev/posts/cisa-ncsc-issue-firestarter-backdoor-warning-bhwqesv4m) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CISA, NCSC issue Firestarter backdoor warning","url":"https://daily.dev/posts/cisa-ncsc-issue-firestarter-backdoor-warning-bhwqesv4m","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cisa-ncsc-issue-firestarter-backdoor-warning-bhwqesv4m"},"datePublished":"2026-04-24T14:51:14.200Z","dateModified":"2026-04-28T01:33:44.952Z","description":"CISA and the UK's NCSC have issued a joint advisory warning about a previously unknown backdoor malware called Firestarter, which was found on a US Federal...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/24aeb7abf33954b86ce60f287f7e39d8?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/24aeb7abf33954b86ce60f287f7e39d8?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cisa-ncsc-issue-firestarter-backdoor-warning-bhwqesv4m","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,malware,cisco","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"CISA, NCSC issue Firestarter backdoor warning"}]} ```