Hackers Exploit Cisco ASA 0-Day to Deploy RayInitiator and LINE VIPER Malware

Security researchers have warned that attackers are exploiting a newly disclosed zero-day in Cisco Secure Firewall Adaptive Security Appliance (ASA) 5500-X Series to deploy RayInitiator and LINE VIPER malware, potentially giving them full control of affected devices.

According to The National Cyber Security Centre (NCSC), which issued detailed guidance and an in-depth malware analysis report, the threat allows arbitrary command execution and data exfiltration as part of a broader escalation in attacker capabilities. Cisco confirmed that the same threat actor responsible for last year’s ASA attacks has developed new techniques to exploit the 5500-X series, and Cisco’s update pages outline patches and configuration changes to close the exploited hole.

The NCSC advises affected organisations to apply patches, monitor logs for unusual activity, implement network segmentation, and report incidents to the NCSC to aid tracking of the threat actor’s methods. Some ASA 5500-X models will reach end-of-support between September 2025 and August 2026, underscoring the need to plan upgrades to modern versions.