UK NCSC warns that attackers exploited Cisco firewall zero-days to deploy RayInitiator and LINE VIPER malware

UK NCSC warns that threat actors exploited recently disclosed Cisco firewall zero-days to deploy new malware families RayInitiator and LINE VIPER, expanding the capabilities of attacks against ASA devices. The report ties the activity to CVE-2025-20362 and CVE-2025-20333, with Cisco noting that a CVE-2025-20363 flaw (CVSS 8.5/9.0) was also addressed in updates affecting ASA, FTD, IOS, IOS XE and IOS XR.

RayInitiator is described as a persistent, multi-stage bootkit that loads LINE VIPER into memory on ASA 5500-X devices, which are often out of support, enabling the attacker to run commands, capture traffic and exfiltrate data. LINE VIPER operates as a user-mode shellcode loader, receiving commands via WebVPN authentication or special network packets, and uses unique tokens and RSA keys per victim for control.

In May 2025 Cisco investigated attacks on several government agencies targeting ASA 5500-X models running VPN web services, with attackers modifying ROMMON on older devices to persist after reboots, and some end-of-life devices listed as affected. According to Cisco’s advisory, these campaigns show advanced evasion and persistence techniques linked to state-backed activity and the ArcaneDoor cluster.