### Executive Summary
After detecting suspicious network traffic suggesting initial access, a detailed analysis of the firmware update process revealed an unauthorized update to the firewall's SPI flash memory.

### Technical Details
- **Firmware Image**: The firmware image checksum did not match the expected value, indicating tampering.
- **Analysis Tools**: Utilized Binwalk and Firmware Mod Kit to dissect the firmware.
- **Findings**: Embedded payload designed for remote command execution.

### Next Steps
Investigate persistence mechanisms that may have been established through this malicious firmware.