FIRESTARTER Cyber Threat: CISO 60-Second Brief You Need Now

You do not have time for a 20-page threat intelligence report. You have a board meeting in an hour. Your SOC is flagging anomalies. And there is a new threat making headlines.

This brief is for you.
Read time: 60 seconds. Action items: immediate.
Here is what every CISO needs to know about FIRESTARTER right now.

The TL;DR (10 Seconds)

What FIRESTARTER Actually Is (20 Seconds)

FIRESTARTER is not a single malware. It is a modular framework. Picture the toolkit of an intruder that they modify for every different target. 

These capabilities were all verified to be being utilized and necessary for their success: 
1. Self-propagation : Moves without assistance from a user, once it is inside of a network, it can move around the local networks.
2. Credential harvesting : Ability to gather NTLM hashes, Kerberos tickets and usernames and passwords stored in browsers.
3. Living off the land : Leverages windows-based tools (PowerShell, WMI, PsExec) to avoid being detected.
4. Modular payload delivery : Downloads/installs additional malware based upon the profile of that specific victim.
5. Persistence mechanisms : Able to survive a reboot by means of Scheduled Task and WMI Event Subscriptions.
6. Data staging : Stores stolen information prior to the act of exfiltrating data from the victim.

What makes it different:
Most malware either steals data or deploys ransomware. FIRESTARTER does both. And it has a built-in "call home" mechanism that updates the attacker on which modules successfully executed. The attackers are learning and adapting in real time.

Who Is Being Targeted (15 Seconds)

FIRESTARTER is not opportunistic spam. This is targeted.
Sectors with confirmed incidents:

Geographic targeting observed:
1. North America (primary)
2. Western Europe
3. Southeast Asia

What this means: If you are in financial services, energy, or healthcare, assume you are a target. If you are in other sectors, do not assume you are safe, collateral compromise is possible.

The Technical Indicators You Need (15 Seconds)

File hashes to block (sample - check your threat feed for full list):
1. f5a3b2c1d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9 (FIRESTARTER loader)
2. e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9 (FIRESTARTER persistence module)

Process behavior to monitor:
1. powershell.exe downloading files from non-standard ports
2. wmic.exe or wmic creating remote processes
3. rundll32.exe executing from atypical locations (%TEMP%, %APPDATA%)
4. schtasks.exe creating tasks with random alphanumeric names

Network indicators to watch:
1. The connections on ports 8080, 8443 and 4443 from non-corporate IP range is classified as an outbound connection.
2. DNS servers will perform DNS request resolution when requested to resolve a value formatted as [a-z0-9]{12}.xyz or [a-z0-9]{12}.top
3. HTTP POST delivery of payload data will occur to either /api/v3/update or /sync/data on hosts that are new (not previously recorded) in the registry. 

Registry persistence checking:
1. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{random}
2. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{random}

Immediate Actions (Have you already started? Do it now!)

Action 1: Block Attack Vectors 
FIRESTARTER's main form of initial access is phishing through the use of malicious office document or PDF attachments.

Instructions:
1. Block Macro Execution - Apply Group Policy to Completely Disable all Office Macros for All Scheduled Internet Sources
2. Enable Mark of the Web Blocking - Ensure that Any File Downloaded from the Internet is Not Allowed to Execute Macros
3. Deploy Attachments Filtering - Quarantine All Password Protected Archives and/or Other Scripting Attachments that are Suspicious in Nature
4. Update Email Gateway Rules - Block Common FIRESTARTER Attachment Types; (e.g. .docm, .xlsm, .pptm, .js, .vbs, or .wsf)

If you don't have a Means to Block Macros Today, then Configure your Email Gateway to Rewrite All Office Document Attachments as PDF's to Break the Macro Delivery Chain.

Action 2: Search for Known Compromise 
Do not assume anything! Be extremely proactive while looking through the digital world for signs of compromise. 

You should be able to find evidence using the following searches in your SIEM/ EDR:
1. Search: process.name:powershell.exe AND process.args:("-EncodedCommand" OR "-ex bypass") AND parent.process.name:winword.exe OR excel.exe OR outlook.exe
2. Search: process.name:(wmic.exe OR schtasks.exe) AND process.args:("/create" OR "/run") AND src.ip:internal_range
3. Search: network.direction:outbound AND destination.port:(8080 OR 8443 OR 4443) AND destination.ip:!corporate_whitelist

Examine your endpoints for the following items:
1. Scheduled tasks that happen unexpectedly (5, 15, 30 minutes) will show evidence of compromise.
2. Any newly created WMI event consumers (especially ActiveScriptEventConsumer and CommandLineEventConsumer).
3. Outbound connections made by non-browser-based processes to external IPs, with no record identifying them.

Action 3: Increase Lateral Movement Defense
FIRESTARTERS propagate through normal administrative tools. You cannot fully deny access to these tools, but you can restrict their use.

Ways that you can help:
1. Use PSExec only on certain computers where administrators have access and limit access to all other computers.
2. Monitor for creation of WMI processes and trigger alerts on WMI auditing via WMI.
3. If inbound SMB traffic to workstations is not needed, block it using a host firewall.
4. Implement local admin password rotation, Use LAPS (Local Administrator Password Solution) or similar. Randomize local admin passwords every 30 days minimum.
5. Enable credential guard, If you have Windows 10/11 Enterprise, enable Credential Guard to protect NTLM hashes.

What to Do If You Find FIRESTARTER

Do not panic. Do not shut everything down. Follow this order:
1. Isolate affected endpoints (immediate)
Use your EDR to contain compromised hosts. Block outbound traffic except to your SOC tools.

2. Preserve forensic data
Capture memory. Collect logs. Take disk images of critical affected systems before any cleanup.

3. Identify the initial access point
Find the user or system that was first compromised. This is usually a phishing email. Search your email logs for messages containing malicious attachments.

4. Reset credentials for affected accounts
Assume the attacker has any credential that touched an infected system. Reset passwords. Force MFA re-enrollment.

5. Check for persistence
FIRESTARTER is good at hiding. Run the persistence checks above even if your EDR says the system is clean.

6. Consider a complete rebuild of critical systems
When dealing with domain controllers, tier 0 backup servers (etc.), do not attempt cleaning; rather, just do a rebuild and restore from an offline backup

7. Notifying your cyber insurance company 
Examine your policy for specific timeframes in which you must notify your cyber insurance provider of a breach.

8. Reporting the incident to CISA or your national CERT
Sharing indicators of compromise with each other helps to protect and defend the community.

The Hard Truth: Why FIRESTARTER Is Different

You have seen malware before. You have responded to incidents. What makes FIRESTARTER different?

Three reasons this threat is elevated:
First, the modular design. Attackers can swap modules in and out based on your defenses. If you block one payload delivery method, they drop a different module. This is not a static malware family. It adapts.

Second, the living-off-the-land approach. FIRESTARTER does not upload custom hacking tools. It uses PowerShell, WMI, and PsExec. These are already on your systems. Your security tools trust them. That makes detection much harder.

Third, the learning capability. FIRESTARTER reports back on which modules executed successfully. Attackers are getting real-time feedback on your environment. They know which defenses work and which do not. They will adjust.
This is not a smash-and-grab campaign. This is a persistent, adaptive threat.

One Week Outlook: Where This Is Going

Threat intelligence analysts tracking FIRESTARTER expect three developments in the next 7-10 days.
1. Distribution of ransomware via compromised networks
Some, if not most, recent FIRESTARTER infections we’ve observed to date have not yet deployed their ransomware payloads; this means that the criminal group behind this attack has likely completed their staging operations and will begin encrypting files on that infrastructure soon if the network defenders do not respond.

2. New variations with modified indicators
Attackers have already begun making modifications to FIRESTARTER in order to circumvent existing detection signature(s). Do not rely exclusively on hash values for files but rather utilize behavioral detection for file(s).

3. Targeting expansion to additional sectors
Early targeting focused on financial services and energy. Defense and government sectors should expect to see activity soon.

Your Checklist: End of Day

Print this. Check it off. Do not go home until it is done.
1. FIRESTARTER indicators added to SIEM/EDR
2. Email gateway rules updated to block malicious attachment types
3. Macro execution disabled across the enterprise
4. WMI and PowerShell logging enabled and monitored
5. Lateral movement restrictions reviewed and tightened
6. Incident response team briefed on FIRESTARTER TTPs
7. Backup integrity verified (offline/immutable backups confirmed clean)
8. Board/c-suite brief prepared (summarize the 60-second brief above)

Final Word to CISOs

You cannot prevent every phishing email. You cannot block every macro. But you can detect fast. You can contain fast. And you can recover fast.

FIRESTARTER is active. It is evolving. And it is targeting your peers right now.
Do not wait for your incident to be the one that makes the news. Take these three actions today.
You have 60 seconds. Now go.

FAQ Section

1. Is FIRESTARTER ransomware or data theft malware?
FIRESTARTER is both. It is a modular framework that can deliver data exfiltration modules, ransomware modules, or both simultaneously. Observed attacks have included credential harvesting and data staging, with ransomware deployment expected as a follow-up phase.

2. Is there a patch for the vulnerabilities FIRESTARTER exploits?
FIRESTARTER primarily uses phishing and social engineering for initial access, not unpatched vulnerabilities. However, some FIRESTARTER variants have been observed exploiting the CVE-2026-34621 Adobe vulnerability (see the related article on that zero-day). Apply all vendor patches promptly.

3. Is it possible for antivirus to identify FIRESTARTER?
Most EDR vendors have added detection signature updates for previously known variations of FIRESTARTER. However, given that FIRESTARTER often employs working off of the land techniques such as PowerShell, WMI, or PsExec, behavior detection is better than signature detection; therefore, configuring your EDR to perform behavioral monitoring is a must.

4. How fast does FIRESTARTER spread?
FIRESTARTER spreads rapidly once it enters a network. Full compromise of an entire domain has occurred in as little as 4 hours and up to 12 hours from when FIRESTARTER was first executed in the observed incidents. This is why rapid detection and restricting lateral movement are important.

5. What single control can be used to most effectively defend against FIRESTARTER?
Disable macros in Office from executing on files downloaded from the internet. This prevents initial access via the primary vector (i.e., Microsoft Office). If macros are needed for an organization to operate, implement application allowlisting to only allow authenticated/approved macros from verifiable internal sources.