The Watch

The Threat

A joint US-UK advisory issued April 24, 2026 confirmed that Chinese APT UAT-4356 has implanted a backdoor called FIRESTARTER on Cisco ASA and Firepower/Secure Firewall devices that survived two complete rounds of patches — including the September 2025 security update most organizations treated as remediation. CISA has escalated to emergency directive status and ordered federal agencies to submit memory snapshots immediately.

This effectively turns your perimeter security appliance into a covert C2 channel — the very device you trust to inspect VPN traffic is parsing it for attacker commands.

How It Works

FIRESTARTER's persistence mechanism is the critical differentiator. It rewrites boot-related configuration to reinstall itself on every reboot — making standard graceful reboots ineffective. It hooks core firewall code to monitor for a specially crafted trigger embedded in VPN-related traffic, then executes attacker-supplied code. The backdoor was discovered by CISA as part of the ongoing ArcaneDoor campaign investigation.

Why Patching Failed

Both sources agree: the persistence mechanism operates at a layer below what firmware patches touch. The September 2025 patches addressed the initial vulnerability but did not detect or remove already-implanted FIRESTARTER code. This means any ASA device compromised before the first patch retained its backdoor through both update cycles — potentially granting UAT-4356 over a year of post-patching persistent access.

Remediation Requirements

Cross-Source Analysis

Both primary sources converge on the severity and remediation, but frame the attribution slightly differently. One source names the actor as UAT-4356 and ties it explicitly to China and the ArcaneDoor campaign. The other describes it as "state-linked" without specifying China in the headline assessment. Both agree CISA discovered the persistence mechanism and that exploitation is still ongoing.

Scope Assessment

If UAT-4356 had persistent access to your network edge for potentially over a year post-patching, this is not a patch deployment — it's a breach investigation. Map what traffic traversed those ASAs, what internal networks they fronted, and whether there are indicators of lateral movement. Deploy out-of-band monitoring on firewall management interfaces that doesn't depend on the potentially compromised firewall itself.

The Vulnerability

Microsoft issued an out-of-band patch for CVE-2026-40372 in ASP.NET Core's DataProtection library — a decision that signals elevated urgency from Redmond itself. The root cause: the managed authenticated encryptor computes its HMAC validation tag over the wrong payload bytes, then discards the computed hash entirely. Cryptographic signature verification is effectively a no-op on Linux and macOS ASP.NET Core deployments. Windows is not affected.

Forged authentication cookies created before patching remain valid after updating to v10.0.7 — unless you explicitly rotate the DataProtection key ring. This is not a normal patch cycle.

Why This Is Worse Than a Standard Critical CVE

Three sources independently emphasize the same dangerous nuance: patching alone is insufficient remediation. An attacker who forged auth cookies during the vulnerability window retains access even after you deploy v10.0.7. You must treat key rotation and session invalidation as atomic remediation steps alongside the code update.

Given that containerized .NET deployments overwhelmingly run on Linux, the blast radius in cloud-native environments is massive. Affected versions span v10.0.0 through v10.0.6.

Simultaneous Critical Patch Queue

CVE-2026-40372 arrives alongside several other high-urgency items competing for your change window:

The Defender Irony

The BlueHammer vulnerability in Microsoft Defender — your endpoint protection — has a public PoC and confirmed active exploitation. CISA added it to KEV with a May 6 deadline. When your EDR is itself the exploit vector, detection assumes a different character entirely. Confirm April 14 Patch Tuesday is deployed with specific attention to the Defender fix on every managed endpoint.

Pack2TheRoot

PackageKit privilege escalation gives unprivileged users root access on Ubuntu, Debian, Fedora, and RockyLinux — essentially every major enterprise Linux distribution. While only PoC-stage, this compounds the Linux-centric blast radius of CVE-2026-40372. Deploy PackageKit patches across your Linux fleet alongside the ASP.NET remediation.

Three Attacks, One Architecture

The supply chain is under coordinated assault across three distinct vectors that share one common trait: they exploit trust relationships your security controls were designed to enforce, not question. A hijacked password manager CLI, a self-propagating package worm, and commoditized OAuth hijacking are all active simultaneously.

1. @bitwarden/cli v2026.4.0 — Your Security Tool Is the Weapon

TeamPCP hijacked the Bitwarden CLI package identity on npm and pushed a malicious version that downloads the Bun runtime and launches a comprehensive credential theft operation. The payload targets GitHub tokens, npm credentials, SSH keys, AWS/GCP/Azure secrets, and — for the first time at this scale — AI tooling configs including Claude and MCP settings. Exfiltration channels include encrypted posts to audit[.]checkmarx[.]cx (implicating Checkmarx infrastructure compromise), GitHub repo creation under victim accounts, and weaponized GitHub Actions for pipeline-wide secret extraction.

This is supply chain inception: your security scanning tool was compromised to attack your password manager's CLI. The blast radius extends to any CI/CD pipeline that consumed the affected Checkmarx GitHub Action since late March.

2. Namastex Labs npm/PyPI Worm — Exponential Blast Radius

Unlike typical typosquat attacks, this malware self-propagates by injecting malicious code into new versions of packages published by compromised developers. Every infected developer who publishes becomes an unwitting distribution vector. The worm has crossed from npm into PyPI, indicating deliberate multi-registry design. It steals credentials, API keys, and cryptocurrency wallets.

3. ConsentFix v3 — APT29's OAuth Hijack Goes Point-and-Click

Originally a Russian APT29 technique tracked since December 2025, ConsentFix has now reached version 3 with full automation: Cloudflare Workers integration, email campaign automation, and automatic token-to-persistent-access exchange. The critical insight: it bypasses MFA, passkeys, AND device compliance checks because the attack occurs at the OAuth consent layer, after authentication succeeds. Users see real Microsoft domains and enter real credentials on real Microsoft infrastructure.

Your conditional access policies don't fire because the authentication itself is legitimate — the attack happens at the consent layer that your identity stack trusts implicitly.

Cross-Source Pattern

Seven independent sources documented aspects of this supply chain wave. The convergence is clear: developer infrastructure is being targeted not as collateral but as the primary objective. The Bitwarden CLI payload specifically harvests AI tooling configs, signaling that threat actors are mapping the new developer tool landscape in real time.

The New Timeline

CVE-2026-33626, an SSRF in LMDeploy (an AI model-serving toolkit), was weaponized in 12 hours and 31 minutes after public disclosure. No proof-of-concept code was published — attackers read the advisory and built working exploits, almost certainly with AI assistance. In an eight-minute reconnaissance session, they port-scanned AWS metadata services, Redis instances, and MySQL databases from inside the network.

Detailed security advisories now function as exploit blueprints when AI-assisted coding tools can translate a vulnerability description into working exploit code in hours.

The Capability Benchmarks

Multiple model releases this week crystallize what AI-accelerated offense looks like:

• GPT-5.5: 81.8% on CyberGym — a material jump in autonomous cyber task completion. API access was delayed pending additional safeguards, suggesting OpenAI's own testing found concerning capabilities.
• GLM-5.1 (Z.ai): 68.7% on CyberGym with zero safety refusals on cybersecurity tasks, under MIT license at $1.40/M tokens. Available on HuggingFace.
• DeepSeek V4-Flash: MIT-licensed, competitive benchmarks, $0.28/M output tokens. Self-hostable with no telemetry.
• Chinese firm 360 Digital Security claims its AI agent discovered 1,000 previously unknown vulnerabilities.

The pattern: capable models + autonomous agents + zero-cost open-source access = fundamentally changed threat landscape.

Autonomous Cloud Exploitation Demonstrated

Researchers built Zealot, a multi-agent system that autonomously executed: network recon → SSRF exploitation → service account token theft → BigQuery enumeration → privilege escalation via storage.objectAdmin → data exfiltration against GCP. This isn't a single step — it's a full kill chain automated end-to-end.

Defensive Bright Spot: Activation Capping

Oxford/Anthropic researchers published activation capping — an inference-time technique that halves jailbreak success rates without degrading model performance:

This is a rare defense-in-depth addition that doesn't trade capability for safety. Evaluate for any open-weight LLMs in customer-facing deployments.

Sources Disagree On: Defensive Parity

UK NCSC chief Richard Horne argues that poor cyber basics remain the bigger risk than AI-novel attacks — fix fundamentals first. This contradicts the panic narrative. He's probably right in aggregate, but the LMDeploy 12-hour weaponization and Zealot's autonomous kill chain demonstrate that for internet-facing AI infrastructure specifically, the threat has already outpaced basic security hygiene alone.