Emergency in the US: Urgent cybersecurity order after key government agency hack

On September 25, 2025, the U.S. Infrastructure Security and Cybersecurity Agency (CISA) issued an emergency order aimed at all civil federal agencies to immediately reinforce their cyber defenses. This measure responds to the infiltration of an advanced group of hackers, allegedly sponsored by a state, who violated at least one government agency by abusing security flaws in Cisco devices known as ASA firewall and Firepower Threat Defense.

‍

Details of the attack and related threats

The attack is part of an extensive espionage campaign called “ArcaneDoor”, which has been exploiting three critical vulnerabilities in Cisco devices for months before being publicly detected. The hackers modified commands to maintain persistence on compromised systems, affecting hundreds of devices at the U.S. federal level and 10 other organizations worldwide.

A senior CISA official said that, although no specific agencies or details of stolen data have been disclosed, the risk is significant and the agency requires that compromised systems be patched and audited urgently to mitigate additional damage and stop new breaches.

‍

Impact and response

This emergency order sparked a race against time in Washington and other administrations to identify, disconnect and remedy affected devices before the deadline set for the Friday following the issuance of the directive. In addition, an increase in attacks is anticipated taking advantage of now-known vulnerabilities and public access to patches.

The UK's National Cybersecurity Center issued a similar alert stating that the malware involved represents an evolutionary leap in hackers' ability to conceal and sophisticate, putting agencies and companies on high alert.

‍

Key recommendations and lessons

• Immediate software update and security patches on critical devices such as Cisco firewalls.
• Extensive audits and continuous monitoring to detect unusual movements or persistence of malware.
• Strengthen policies for access and use of minimum privileges in federal networks.
• Promote international collaboration between agencies and suppliers to share intelligence and improve rapid response to advanced threats.

‍

🛡️ At Apolo Cybersecurity, we offer you comprehensive assessments, advanced training and proactive services to shield your systems against sophisticated threats.

CISA's emergency order in the face of a massive attack on critical federal infrastructure highlights the current high level of threat and the importance of taking rapid and coordinated action. As known vulnerabilities become public, the window of opportunity for attackers widens, making preparedness, defense and response crucial to national and corporate security.

Is your organization prepared to respond to incidents of this magnitude?

‍