Full Report
Cisco Talos is aware of UAT-4356's continued active targeting of Cisco Firepower devices’ Firepower eXtensible Operating System (FXOS). UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.
Analysis Summary
# Threat Actor: UAT-4356
## Attribution & Identity
- **Name/Alias:** UAT-4356
- **Known Associations:** State-sponsored threat actor.
- **Campaign Names:** ArcaneDoor.
- **Related Group Artifacts:** Significant technical overlap with infrastructure/shellcode associated with **RayInitiator** (specifically Stage 3 shellcode and its endpoint API processing).
## Activity Summary
UAT-4356 is engaged in a continued, sophisticated campaign targeting the perimeter of high-value networks. Their 2026 activity involves the exploitation of n-day vulnerabilities in Cisco Firepower devices to deploy a custom, memory-resident backdoor for long-term espionage and persistence on networking hardware.
## Tactics, Techniques & Procedures
- **Exploitation:** Leverages n-day vulnerabilities **CVE-2025-20333** and **CVE-2025-20362** to gain unauthorized access to Cisco FXOS.
- **Persistence:** Employs a transient persistence mechanism by manipulating the Cisco Service Platform mount list (`CSP_MOUNT_LIST`). The malware monitors for runlevel 6 (reboot) to back itself up and re-inject into the boot sequence.
- **In-Memory Injection:** Injects malicious shellcode into the **LINA** process (core component of ASA/FTD appliances).
- **Function Hooking:** Overwrites internal data structures to replace legitimate WebVPN XML handler functions with pointers to malicious shellcode.
- **Evasion:**
- Self-deletes from disk (`/usr/bin/lina_cs`) and restores original mount lists once active in memory.
- Operates as a "passive" backdoor that only triggers when specific magic bytes/prefixes are detected in incoming XML requests.
- Persistence is "transient," meaning a hard power cycle removes the implant from the device.
## Targeting
- **Sectors:** Network Perimeter Infrastructure (high-interest espionage targets).
- **Geography:** Globally distributed targets focusing on Cisco ASA and FTD appliances.
- **Victims:** Explicit organizations are not named in this report, but targeting focuses on users of Cisco Firepower/FXOS devices.
## Tools & Infrastructure
- **Malware:**
- **FIRESTARTER:** A custom backdoor specifically designed for Cisco FXOS and the LINA process.
- **RayInitiator Stage 3:** (Associated artifact/shared capability).
- **Files/Paths:**
- `/usr/bin/lina_cs`
- `/opt/cisco/platform/logs/var/log/svc_samcore.log`
- `CSP_MOUNTLIST.tmp`
## Implications
UAT-4356 represents a highly capable state-sponsored threat focusing on the "structural" layer of the internet. By targeting perimeter devices through n-day exploitation, they bypass traditional endpoint security. Their ability to hook into core network processing (LINA) allows for nearly invisible data interception and arbitrary code execution, signaling a high-level strategic interest in persistent access to encrypted traffic and network internal operations.
## Mitigations
- **Patch Management:** Immediate application of software upgrades for **CVE-2025-20333** and **CVE-2025-20362**.
- **Detection Commands:** Monitor CLI output for unauthorized processes using `show kernel process | include lina_cs`.
- **System Integrity:** Monitor for the presence of files `/usr/bin/lina_cs` and `/opt/cisco/platform/logs/var/log/svc_samcore.log`.
- **Recovery:** A full **reimaging** of the device is recommended for confirmed infections. If re-imaging is not immediate, killing the `lina_cs` process (on non-lockdown FTD) followed by a reload may mitigate the current infection.
- **Hard Reboot:** Because the persistence is transient and relies on graceful shutdowns, a physical power cycle (unplugging) can assist in removing the temporary presence of the implant.
- **Network Security:** Deploy Snort rules **65340, 46897, and 62949** to detect exploit attempts and FIRESTARTER activity.