NCSC Exposes Advanced Bootkit: RayInitiator and LINE VIPER Malware Found on Cisco ASA Devices

On 30 September 2025, the UK’s National Cyber Security Centre released a malware analysis report exposing RayInitiator and LINE VIPER, two sophisticated tools targeting Cisco ASA devices. The NCSC describes RayInitiator as a persistent multi-stage bootkit that enables LINE VIPER to run on Cisco ASA 5500-X series devices without secure boot by patching the GRUB bootloader, gaining early execution during startup.

LINE VIPER is a user-mode shellcode loader that can be delivered via WebVPN client authentication sessions over HTTPS or through ICMP with responses over raw TCP, and it can execute privileged CLI commands, perform stealth packet captures, bypass AAA authentication, harvest administrator commands, and force reboots to hinder forensics.

The report highlights that LINE VIPER uses per-victim RSA keys to secure tasking and exfiltration, encrypted by AES channels, making analysis more difficult without the attacker’s private keys. Cisco has issued guidance and patches, and defenders are advised to replace obsolete Cisco ASA hardware and apply the provided detection guidance to hunt for indicators of compromise.