CISA analyzed FIRESTARTER malware, a backdoor used by APT actors for persistence on Cisco Firepower and Secure Firewall devices running ASA or FTD software. The malware exploits CVE-2025-20333 and CVE-2025-20362 to gain initial access and maintains persistence even after firmware updates and device reboots. FIRESTARTER installs hooks in LINA to execute arbitrary shell code and can survive patching efforts. Only a hard power cycle can remove the malware's persistence mechanism.