CISA: US agency breached through Cisco vulnerability, FIRESTARTER backdoor allowed access through March

A US government agency was compromised by exploiting a Cisco vulnerability, granting hackers access through a backdoor called FIRESTARTER as recently as March. The breach, disclosed by the Cybersecurity and Infrastructure Security Agency (CISA), highlights the effectiveness of this malware in allowing attackers to re-establish connections without needing to re-exploit the initial vulnerabilities. The specific Cisco vulnerability used in the attack was not disclosed, but the fact that it was exploitable through March suggests a potentially widespread issue. The use of the FIRESTARTER backdoor demonstrates a sophisticated approach by the attackers, enabling them to maintain access to the compromised system. This incident has significant implications for the security posture of government agencies and private organizations alike, as it may lead to increased scrutiny of supply-chain vulnerabilities and downstream regulatory effects¹. The breach matters to cybersecurity practitioners because it underscores the need for continuous monitoring and patching of critical infrastructure to prevent similar attacks.