US, UK agencies warn hackers were hiding on Cisco firewalls long after patches were applied

2026-04-23T20:51:56Z5269a023a328178d59578ed29f6b99959dfc94354b4ba850a6ff7a9c66feb605
AI-generated-malwareCISACISOChina-NexusCiscoDiameterDigitalMintFirestarterOT-malwareSS7Scattered SpiderUK-NCSCZionSiphoncommercial-surveillance-toolscovert-networksfirewallgeofence-warrantspersistenceprivacy-billransomwarereal-time-riskrouterstelecom-signallingwater-sector

What happened

Multiple CyberScoop stories describe elevated, broad-ranging cyber threats and related policy/legal developments. Key technical threats: a malware campaign dubbed “Firestarter” was found persisting on Cisco firewalls in a federal network despite patches (US/UK agencies warned); researchers mapped surveillance campaigns that leverage commercial surveillance products to exploit long‑standing telecom signalling vulnerabilities; allied agencies warned Chinese‑linked actors are repurposing everyday routers to build covert networks. Other items: Dragos assessed the AI‑assisted OT malware “ZionSiphon

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
cyberscoop
Record identifier
5269a023a328178d59578ed29f6b99959dfc94354b4ba850a6ff7a9c66feb605
Enrichment time
2026-04-23T20:51:56Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.