Cisco ASA/FTD flaws exploited with persistent implant
Attackers are chaining Cisco Secure Firewall ASA and FTD vulnerabilities for remote code execution, and the resulting implant can survive patching.
Japan's IPA has reissued a security alert covering vulnerabilities in Cisco Secure Firewall ASA and Cisco Secure FTD that allow remote code execution and denial-of-service when chained with an access-control bypass flaw. IPA confirmed active exploitation in the wild and warned that damage could expand, urging organizations to patch immediately.
Mentioned in this report
Detection guidance
Cisco ASA/FTD Suspicious Process Execution Post-Exploitation
Detects unusual process spawning from Cisco ASA/FTD system processes following exploitation attempts, indicating post-exploitation code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco ASA/FTD Suspicious Process Execution Post-Exploitation
description: Detects process creation from Cisco ASA/FTD core system processes (lina,
dm-agent) with unusual command-line patterns or binary names indicative of post-exploitation
activity. These processes should not spawn child processes in normal operation.
tags:
- attack.execution
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /lina
- /dm-agent
Image|endswith:
- /bash
- /sh
- /curl
- /wget
- /nc
- /python
- /perl
filter_legitimate_maintenance:
CommandLine|contains:
- tech-support
- logging
condition: selection and not filter_legitimate_maintenance
falsepositives:
- Cisco administrative tools or system update scripts spawning shell subprocesses
- Vendor-supplied diagnostics or logging utilities
level: high
id: e1b16281-83eb-56bd-9146-5516c6ca4c03
status: experimental
author: Vorant
Cisco ASA/FTD Firmware Modification or Pre-OS Boot Persistence
Detects attempts to write to Cisco ASA/FTD flash memory, NVRAM, or bootloader regions, indicative of firmware modification or pre-OS persistence implantation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco ASA/FTD Firmware Modification or Pre-OS Boot Persistence
description: Detects file write operations targeting Cisco ASA/FTD critical boot and
firmware storage locations (flash:, disk0:, NVRAM) from unexpected processes. Legitimate
firmware updates typically flow through authenticated management interfaces, not
direct filesystem writes.
tags:
- attack.persistence
- attack.t1542
logsource:
category: file_event
product: cisco_asa
detection:
selection:
TargetFilename|startswith:
- 'flash:'
- 'disk0:'
- 'disk1:'
TargetFilename|endswith:
- .bin
- .img
- .asa
Image|endswith:
- /lina
- /dm-agent
EventType: WriteFile
filter_admin_update:
User|endswith: admin
condition: selection and not filter_admin_update
falsepositives:
- Legitimate Cisco software image deployment via HTTPS management plane
- Factory firmware restoration or recovery procedures
level: critical
id: 04076a3b-eb5d-5307-ac34-61b440fe9996
status: experimental
author: Vorant
Cisco ASA/FTD Unauthorized Access Control Bypass with System Modification
Detects network connections to Cisco ASA/FTD management or data plane interfaces combined with suspicious system file modifications, suggesting access-control bypass exploitation followed by persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco ASA/FTD Unauthorized Access Control Bypass with System Modification
description: Correlates external network connections to Cisco ASA/FTD administrative
ports or sensitive interfaces with subsequent writes to critical system configuration
or binary paths, indicating exploitation of access-control flaws combined with post-exploitation
persistence setup.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: network_connection
product: cisco_asa
detection:
selection_network:
DestinationPort:
- 443
- 8305
- 8307
Protocol: tcp
EventType: connection_established
selection_suspicious_source:
SourceAddress|startswith:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
SourceAddress: '!127.0.0.1'
filter_internal_mgmt:
SourceAddress|startswith:
- 10.0.1.0/24
condition: selection_network and selection_suspicious_source and not filter_internal_mgmt
falsepositives:
- Legitimate remote administration from internal networks
- Authorized third-party security assessments or monitoring
level: medium
id: 4c665b37-f7bd-5895-9d75-54b4eeb3baf1
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2025/alert20251106.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free