Loading malware…
RayInitiator is a persistent multi-stage GRUB bootkit used to compromise Cisco ASA 5500-X series devices that lack secure boot. It is associated with exploitation of Cisco ASA and FTD WebVPN vulnerabilities including CVE-2025-20333 and CVE-2025-20362, and has been linked to the ArcaneDoor activity cluster and the threat actor tracked as UAT-4356. The malware is designed to survive device reboots and firmware upgrades by implanting into the boot chain and persisting in ROM on affected appliances.
RayInitiator facilitates deployment of the LINE VIPER user-mode shellcode loader on compromised Cisco ASA devices. Its multi-stage execution chain modifies GRUB and later patches kernel and user-space execution paths to establish a handler inside the ASA lina process. In its deployment stage, it hooks WebVPN XML processing so that specially crafted authentication traffic can trigger in-memory loading and execution of LINE VIPER. Observed behavior includes validating victim-specific identifiers, extracting staged shellcode from WebVPN-related data, and changing memory protections to execute payloads inside lina.
The malware targets perimeter security appliances, particularly older Cisco ASA 5500-X systems without secure boot, making it especially relevant to government and other high-value networks that rely on such edge devices. RayInitiator’s role is primarily to provide durable pre-boot persistence and a covert execution path for follow-on tooling rather than to directly perform broad post-exploitation tasks itself. Subsequent capabilities observed in the broader intrusion set are delivered through LINE VIPER, which RayInitiator loads into memory. RayInitiator has also been cited as technically similar to later tooling such as FIRESTARTER, suggesting shared development lineage within the same operator ecosystem.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2025-20333 (CVSSv3.1 skóre 9,9) sa nachádza v komponente VPN Web Server a spočíva v nedostatočnom overovaní používateľských vstupov v HTTP(S) požiadavkách. Vzdialený autentifikovaný útočník s platnými prihlasovacími údajmi VPN by zraniteľnosť zaslaním špeciálne vytvorených HTTP požiadaviek mohol zneužiť na vzdialené vykonanie kódu a získanie úplnej kontroly nad systémom. Zraniteľnosť je v súčasnosti aktívne zneužívaná. | NCSC-UK v súvislosti so zneužitím zraniteľností identifikovalo dva nové malwary RAYINITIATOR a LINE VIPER. RayInitiator je perzistentný GRUB (GRand Unified Bootloader) bootkit, ktorý sa flashuje do pamäte ROM a je schopný prežiť reštarty zariadenia a upgrady firmvéru.
CVE-2025-20362 (CVSSv3.1 skóre 7,7) spočíva v nedostatočnom overovaní používateľských vstupov v rámci HTTP(S) požiadaviek s nedostatočnej implementácii mechanizmov autentifikácie. Vzdialený neautentifikovaný útočník by ju mohol zneužiť na obídenie mechanizmov autentifikácie a získanie prístupu k URL koncovým bodom, ktoré by mali byť prístupné len pre prihlásených používateľov. Zraniteľnosť je v súčasnosti aktívne zneužívaná. | NCSC-UK v súvislosti so zneužitím zraniteľností identifikovalo dva nové malwary RAYINITIATOR a LINE VIPER. RayInitiator je perzistentný GRUB (GRand Unified Bootloader) bootkit, ktorý sa flashuje do pamäte ROM a je schopný prežiť reštarty zariadenia a upgrady firmvéru.
Cisco ASA Firewall Zero-Day Exploits Deploy RayInitiator and LINE VIPER Malware
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cisco Talos noted that Firestarter shares significant technical similarities with a previously documented implant called RayInitiator, suggesting the tools share a common origin or development history within UAT-4356’s arsenal.
After the flaws had been fixed, the U.K. NCSC reported that threat actors exploited them in zero-day attacks to deploy novel malware families, RayInitiator and LINE VIPER. RayInitiator is a persistent, multi-stage GRUB bootkit flashed to Cisco ASA 5500-X devices (many out of support) that survives reboots and firmware upgrades.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
CVE-2025-20333 sa nachádza v komponente VPN Web Server ... Vzdialený autentifikovaný útočník s platnými prihlasovacími údajmi VPN by zraniteľnosť zaslaním špeciálne vytvorených HTTP požiadaviek mohol zneužiť na vzdialené vykonanie kódu... | CVE-2025-20362 ... Vzdialený neautentifikovaný útočník by ju mohol zneužiť na obídenie mechanizmov autentifikácie a získanie prístupu k URL koncovým bodom, ktoré by mali byť prístupné len pre prihlásených používateľov.
LINE VIPER and RayInitiator utilise victim specific tokens... To check for a LINE VIPER request, the <group-select> element is verified to ensure it starts with a hard-coded, victim specific, 8-byte ASCII string... LINE VIPER tasking payloads sent to victim devices are checked for multiple victim-specific tokens before they are run.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Previously disclosed bootkit noted as technically similar to FIRESTARTER.
Referenced as a malware/tool whose deployment tactics substantially overlap with FIRESTARTER’s loading mechanism.
A previously documented bootkit noted only as having overlap with FIRESTARTER.
A previously documented implant that shares significant technical similarities with Firestarter, suggesting common origin or development history within UAT-4356’s toolset.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.