Cisco ASA Firewall Zero-Day Exploits Deploy RayInitiator and LINE VIPER Malware

The UK’s National Cyber Security Centre (NCSC) has said threat actors exploited recently disclosed Cisco ASA firewall flaws in zero-day attacks to deploy undocumented malware families named RayInitiator and LINE VIPER. Cisco reported that attacks on multiple government agencies began in May 2025, targeting ASA 5500-X devices to implant malware, run commands, and potentially exfiltrate data, with a memory corruption bug identified in the process.

The campaign uses CVE-2025-20362 (CVSS 6.5) and CVE-2025-20333 (CVSS 9.9) to bypass authentication and execute code, and is linked to a threat cluster called ArcaneDoor, attributed to a suspected China-linked group UAT4356 (Storm-1849). RayInitiator is a GRand Unified Bootloader bootkit that survives reboots and loads LINE VIPER, which can issue CLI commands, perform packet captures, bypass VPN AAA, suppress syslog, and harvest CLI commands.

The NCSC noted LINE VIPER communicates with a C2 server via WebVPN HTTPS or ICMP, and that Lina is the ASA’s underlying operating system modified to help persistence; some ROMMON changes were observed on older ASA models lacking Secure Boot.