Explore

Rapid Read Rapid Read
Firestarter Malware Persists Despite Cisco Firewall Patches

Firestarter Malware Persists Despite Cisco Firewall Patches

The Firestarter malware, associated with the ArcaneDoor threat actor, has been found to persist in Cisco's Firepower and Secure Firewall devices despite security patches released in September last year. This malware, identified as a Linux binary, embeds itself in the Firepower eXtensible Operating System (FXOS) base layer, surviving device reboots and evading detection. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the UK's National Cyber Security Centre (NCSC) have issued alerts, advising organizations to follow emergency directives, including physically disconnecting affected firewalls to disrupt the malware's persistence.
Rapid Read Rapid Read
Cisco Confirms 'Firestarter' Malware Persists Despite Firewall Patches, Urges Hard Reboot

Cisco Confirms 'Firestarter' Malware Persists Despite Firewall Patches, Urges Hard Reboot

Cisco has acknowledged that the 'Firestarter' malware, deployed by the ArcaneDoor threat actor, remains active despite security patches released in September last year. This malware affects the Firepower and Secure Firewall devices by embedding itself as a Linux binary in the Firepower eXtensible Operating System (FXOS). It survives device reboots by copying itself to a log directory and manipulating the storage mount list. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and Britain's National Cyber Security Centre (NCSC) have named the malware 'Firestarter'. CISA advises organizations to perform a hard reboot by unplugging the devices to disrupt the malware's persistence routine.
Trendline Trendline
Cybersecurity Analysts in High Demand as Cyber Threats Escalate

Cybersecurity Analysts in High Demand as Cyber Threats Escalate

Cybersecurity Analysts in High Demand as Cyber Threats Escalate
Rapid Read Rapid Read
Former Ransomware Negotiator Admits to Aiding Cybercriminals in Extortion Scheme

Former Ransomware Negotiator Admits to Aiding Cybercriminals in Extortion Scheme

A former ransomware negotiator has pleaded guilty to aiding a ransomware group in extorting tens of millions of dollars from companies. The individual, Martino, was involved in providing the ransomware group with sensitive information, such as companies' insurance policy limits and internal negotiation positions, in exchange for a share of the profits. This information was used to facilitate the ransomware attacks, which included the deployment of Blackcat ransomware against multiple U.S. victims between April and November 2023. Law enforcement has seized $10 million in assets from Martino, including digital currency and luxury items. The case highlights the betrayal of trust by Martino, who was employed by the cybersecurity firm DigitalMint, and his collaboration with two other individuals, Ryan Goldberg and Kevin Martin, in the extortion scheme.
Trendline Trendline
Jennifer Beckage Recognized for Cybersecurity Leadership in New York

Jennifer Beckage Recognized for Cybersecurity Leadership in New York

Jennifer Beckage Recognized for Cybersecurity Leadership in New York
Rapid Read Rapid Read
New York Yankees and Rangers Fans Face High Risk of Password Breaches, Study Finds

New York Yankees and Rangers Fans Face High Risk of Password Breaches, Study Finds

A recent study by Duelbits has revealed that fans of the New York Yankees and New York Rangers are among the most at risk for password breaches. The study found that over 1.2 million passwords related to the Yankees and 1.1 million related to the Rangers have been compromised. The research analyzed password variations linked to sports teams across the MLB, NBA, NHL, and NFL, highlighting the vulnerability of using team names in passwords. The findings suggest that sports fans, particularly those in New York, should consider changing their passwords to avoid potential security risks.
Rapid Read Rapid Read
BlackFile Group Intensifies Vishing Attacks on Retail and Hospitality Sectors

BlackFile Group Intensifies Vishing Attacks on Retail and Hospitality Sectors

Security researchers have identified a new extortion group, BlackFile, which has been targeting retail and hospitality businesses since February 2026. The group, linked to the activity cluster CL-CRI-1116, is known for its financially motivated attacks. Unlike other cybercriminals, BlackFile does not use custom malware but exploits legitimate internal resources and APIs. They employ vishing attacks, impersonating IT helpdesks to steal credentials and one-time passwords. The attackers use spoofed VoIP numbers and fraudulent Caller ID Names to conceal their identities. Once they gain access, they register new devices to bypass multi-factor authentication and maintain persistence. The group focuses on SaaS data discovery and API abuse, exfiltrating data through browsers or API exports. They demand ransom through random Gmail addresses or compromised employee emails, sometimes resorting to SWAT-ing to force payment.
Rapid Read Rapid Read
Chinese Hacker Extradited to U.S. for Alleged Cyberattacks on Universities and Corporations

Chinese Hacker Extradited to U.S. for Alleged Cyberattacks on Universities and Corporations

Xu Zewei, accused of conducting cyberattacks on behalf of the Chinese government, has been extradited to the United States. The U.S. Justice Department charged Xu with working for the Chinese Ministry of State Security to execute cyberattacks targeting U.S. universities and corporations. These attacks aimed to steal COVID-19 research and exploit vulnerabilities in Microsoft Exchange servers. Xu was arrested in Italy and is now detained in Houston, Texas. His extradition marks a significant development in U.S. efforts to hold foreign hackers accountable for cyber espionage.
Trendline Trendline
Anthropic's Mythos AI Uncovers Over 2,000 Software Vulnerabilities, Raising Cybersecurity Concerns

Anthropic's Mythos AI Uncovers Over 2,000 Software Vulnerabilities, Raising Cybersecurity Concerns

Anthropic's Mythos AI Uncovers Over 2,000 Software Vulnerabilities, Raising Cybersecurity Concerns
Rapid Read Rapid Read
FIRESTARTER Malware Compromises Federal Cisco Devices, Evades Security Patches

FIRESTARTER Malware Compromises Federal Cisco Devices, Evades Security Patches

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has disclosed that a federal civilian agency's Cisco Firepower device was compromised by a malware known as FIRESTARTER. This backdoor malware, which was deployed in September 2025, allows remote access and control of the device. Despite security patches, FIRESTARTER persists on devices running Cisco's Adaptive Security Appliance (ASA) software. The malware exploits vulnerabilities such as CVE-2025-20333 and CVE-2025-20362, which have been patched, but devices compromised before the patches remain vulnerable. The malware's persistence is facilitated by a toolkit called LINE VIPER, which enables various malicious activities, including bypassing VPN authentication and executing commands.
Trendline Trendline
Firestarter Malware Persists Despite Cisco Firewall Patches

Firestarter Malware Persists Despite Cisco Firewall Patches

Firestarter Malware Persists Despite Cisco Firewall Patches
Trendline Trendline
OpenSSH Vulnerability Exposes Servers to Root Access for 15 Years

OpenSSH Vulnerability Exposes Servers to Root Access for 15 Years

OpenSSH Vulnerability Exposes Servers to Root Access for 15 Years