Ongoing Exploitation of Cisco Firewalls

Target Industry

Government, Critical Infrastructure, High-Value Enterprises.

Overview

A new state-backed espionage campaign, assessed with high confidence to be linked to ArcaneDoor (tracked as Storm-1849), is exploiting two zero-day vulnerabilities CVE-2025-20333 and CVE-2025-20362 in Cisco Adaptive Security Appliance (ASA) 5500-X and Firepower Threat Defense (FTD) devices. The threat actor is deploying RayInitiator, a persistent GRUB bootkit, and LINEVIPER, an advanced user-mode implant.

Both malware families allow the attacker to gain long-term, covert access to perimeter devices, capture sensitive traffic, and bypass authentication controls. Cisco, CISA, the Canadian Centre for Cyber Security, and the NCSC have all issued urgent guidance warning of active exploitation.

Impact

The exploitation of these Cisco ASA and FTD zero-days represent a significant nation-state espionage threat with potentially crippling consequences for government, critical infrastructure, and high-value enterprises. Successful compromise provides attackers with long-term, covert access to perimeter devices, enabling interception of sensitive traffic, theft of credentials, and bypass of core authentication controls. The persistence mechanisms deployed – including a GRUB bootkit and advanced implants – mean that intrusions are likely to remain undetected for extended periods, giving adversaries a substantial dwell time advantage. If compromises are only discovered after such prolonged activity, the costs of incident response and remediation, including full device rebuilds, forensic investigations, and widespread credential resets, could be severe.

Beyond organisational disruption, these intrusions risk degrading national security posture at a time of heightened geopolitical tension, undermining trust in critical systems and potentially impacting allied communications and defensive readiness if the strategic and operational objectives of the offending nation-states are met.

Exploitation

Fake emails are being sent, pretending to be from PyPI, urging users to verify their email to avoid account suspension. The threat of suspension is used to create a sense of urgency. Users are then directed to a mirror website that closely replicates PyPI’s login interface, including logos and styling. The threat actors harvest the credentials entered on the fake site.

Affected Products

Affected versions span the release branches of Cisco ASA and FTD 9.x and 6.x software versions.

Vulnerability Details

CVE-2025-20333 (CVSS v3.1: 9.9 – Critical)

CVE-2025-20333 is a critical vulnerability in the VPN web server component of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defence (FTD) Software. The flaw arises from improper validation of user-supplied input in HTTP(S) requests. Exploitation allows an authenticated, remote attacker to execute arbitrary code directly on an affected device. Given that these firewalls often sit at the network perimeter, successful exploitation provides adversaries with direct control of the device and access to decrypted VPN traffic.

Cisco has yet to issue patches affecting multiple 9.x (ASA) and 6.x (FTD) software release branches; therefore, administrators are strongly urged to implement the mitigations below:

Restricting VPN access to only essential users and networks.

Enforcing strict authentication controls, ideally with MFA.

Monitoring VPN authentication logs for anomalies such as unusual login times, geolocations, or repeated failures.

Applying network segmentation to reduce lateral movement opportunities.

This vulnerability represents the primary intrusion vector in the current ArcaneDoor-linked campaign and should be treated with the highest priority for remediation.

EPSS: Unrated as of ICOD.

CVE-2025-20362 (CVSS v3.1: 6.5 – Medium)

CVE-2025-20362 is a medium-severity vulnerability in the same VPN web server component of Cisco ASA and FTD. Unlike CVE-2025-20333, this flaw enables an unauthenticated, remote attacker access to restricted URL endpoints without proper authentication. While it does not provide direct code execution, it can facilitate credential harvesting, reconnaissance, or privilege escalation, and it may be changed with other flaws to enable deeper compromise.

Cisco has yet to release corresponding patches, so in the interim, organisations should:

Restrict external network access to VPN web interfaces wherever possible.

Deploy intrusion detection/prevention signatures to identify exploit attempts.

Closely monitor logs for suspicious authentication bypass attempts.

Apply conditional segmentation and access controls to reduce the impact of potential exploitation.

Although its CVSS rating is lower than CVE-2025-20333, the vulnerability’s role in authentication bypass means it can serve as a precursor to a more serious compromise and should not be underestimated.

EPSS: Unrated as of ICOD.

Exploitation

The adversary’s exploitation in this campaign centres on two complementary malware families that together provide a resilient, covert foothold on perimeter Cisco ASA/FTD devices: RayInitiator, a GRUB-level bootkit that patches the early boot flow and the ASA loader to survive reboots and many firmware updates, and LINEVIPER, an x86_64 user-mode implant and shellcode loader delivered via crafted WebVPN authentication blobs or cover ICMP channels. LINEVIPERs modular payloads and per-victim RSA keys enable targeted tasking, packet capture, CLI command execution, syslog suppression, credential harvesting, and selective exfiltration, while RayInitiator ensures those implants persist through routine maintenance. Together, these capabilities let the actor intercept decrypted VPN and administrative traffic at the network edge, quietly harvesting credentials and session data for lateral access, and suppress forensic artefacts to lengthen dwell time – precisely the operational mechanisms needed to sustain long-term nation-state espionage and produce strategic intelligence advantages.

Containment, Mitigations & Remediations

Immediate (0-24 hours) – treat this as an emergency: identify all ASA/FTD devices, prioritise those with public-facing WebVPN interfaces, and apply vendor guidance without delay. CISA has issued an emergency directive and added these exploit-targeted CVEs to the Known Exploited Vulnerabilities list; federal and government agencies were ordered to account for and mitigate affected devices within 24 hours.

Apply vendor patches when available as the first priority; follow Cisco’s published advisories and any staged emergency fixes or workarounds.

Isolate or block access to affected WebVPN management interfaces at the network edge – e.g., block inbound TCP/UDP to the VPN/web interfaces using upstream ACLs or firewall rules, or place the device behind an access-control gateway. Cisco and NCSC guidance explicitly recommend limiting exposure of the web/VPN management plane.

Containment & Traige (24-72 hours) – Assume high likelihood of compromise given observed exploitation. Treat affected devices as potential footholds until proven otherwise.

Take a forensically-sound image (or complete backup) of device storage and configuration before attempting remediation or upgrades where possible; collect volatile memory and full configuration files for offline analysis. NCSC and partner advisories emphasise the collection of device artefacts to support investigation.

Where RayInitiator/bootkit indicators are present, a firmware reflash alone may be insufficient – affected devices should be rebuilt from known-good images or replaced (particularly for end-of-life models lacking secure-boot). NCSC’s malware analysis shows GRUB-level persistence survives many routine updates.

Assume credential compromise; reset administrative credentials, VPN user credentials, and any service accounts that were managed via the device. Replace any keys/certificates that may have been exposed.

Detection & Monitoring (short-medium term) – hunt for indicators and increase telemetry.

Hunt for specific IOCs and behaviours described in vendor and NCSC reporting (abnormal WebVPN blobs, unexpected ICMP-style traffic, line hooking, syslog suppression, unusual CLI activity). Prioritise timeline analysis for login events and unusual configuration changes.

Forward firewall logs, VPN authentication logs, and management-plane telemetry to a centralised SIEM for correlation; deploy or update IDS/IPS signatures to detect exploit attempts as advised by Cisco and partners.

Threat Landscape

PyPI is the default repository for Python packages accessed via pip, the standard Python package installer. It supports millions of developers globally, underpinning a wide range of applications from data science to web development and machine learning. This campaign underscores the importance of monitoring domain registrations and verifying the authenticity of email communications.

Threat Landscape

As geopolitical tensions continue to escalate, more aggressive and technically sophisticated cyber operations should be expected from state-aligned groups seeking to advance national strategic objectives. Critical nation infrastructure is an attractive target because it provides visibility into sensitive communications. By compromising VPN gateways and firewalls, adversaries can intercept internet traffic at scale, harvest administrative credentials, and quietly position themselves to conduct long-term espionage against government, military, and high-value enterprises.

This campaign illustrates a broader trend: deliberate use of zero-day exploitation against widely deployed edge devices to establish durable footholds that survive conventional patch cycles. Nation-state actors are demonstrating a willingness to invest in developing bootkits, implants, and bespoke persistence techniques that complicate detection and remediation. As tensions rise globally, such operations are increasingly aimed at undermining trust in critical systems, eroding defensive readiness, and extracting intelligence that can shift diplomatic or military balances in the adversary’s favour.

TTPs

Below is an amalgamation of Techniques extracted from malware reports, advisories, and additional information provided in this bulletin.