US, UK agencies warn hackers were hiding on Cisco firewalls long after patches were applied
2026-04-23T20:51:56Z•5269a023a328178d59578ed29f6b99959dfc94354b4ba850a6ff7a9c66feb605
AI-generated-malwareCISACISOChina-NexusCiscoDiameterDigitalMintFirestarterOT-malwareSS7Scattered SpiderUK-NCSCZionSiphoncommercial-surveillance-toolscovert-networksfirewallgeofence-warrantspersistenceprivacy-billransomwarereal-time-riskrouterstelecom-signallingwater-sector
What happened
Multiple CyberScoop stories describe elevated, broad-ranging cyber threats and related policy/legal developments. Key technical threats: a malware campaign dubbed “Firestarter” was found persisting on Cisco firewalls in a federal network despite patches (US/UK agencies warned); researchers mapped surveillance campaigns that leverage commercial surveillance products to exploit long‑standing telecom signalling vulnerabilities; allied agencies warned Chinese‑linked actors are repurposing everyday routers to build covert networks. Other items: Dragos assessed the AI‑assisted OT malware “ZionSiphon
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cyberscoop
- Record identifier
- 5269a023a328178d59578ed29f6b99959dfc94354b4ba850a6ff7a9c66feb605
- Enrichment time
- 2026-04-23T20:51:56Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.