Loading threat actor…
ArcaneDoor is a state-sponsored cyber-espionage activity cluster targeting perimeter network infrastructure, especially Cisco ASA and Cisco Firepower Threat Defense appliances. The activity is tracked by Cisco as UAT4356 and by Microsoft as Storm-1849. Reporting has also referred to the actor or campaign itself as ArcaneDoor. Available evidence links the operation to Chinese state interests, and multiple references characterize it as China-affiliated or China-linked, although some vendors have stopped short of definitive public country attribution. The actor is notable for exploiting zero-day and other vulnerabilities in internet-facing security appliances, including Cisco ASA and FTD devices, to obtain remote code execution and elevated privileges. Observed exploitation has included abuse of WebVPN traffic and clientless SSL VPN-related functionality. ArcaneDoor has been associated with the exploitation of CVE-2024-20353 and CVE-2024-20359 in 2024, and later activity tied to the same cluster involved CVE-2025-20333 and CVE-2025-20362 in 2025. Post-compromise tradecraft includes deployment of bespoke malware and backdoors such as Line Runner, Line Dancer, FIRESTARTER, and the LINE VIPER toolkit. These capabilities have been used for reconnaissance, command execution, packet capture, collection of device and system configuration data, exfiltration over existing command-and-control channels, and possible lateral movement. The actor has also demonstrated sophisticated defense evasion and persistence techniques, including modification of authentication, authorization, and accounting behavior to bypass normal controls, suppression or disabling of logging, interception or harvesting of administrator CLI activity, intentional crashing of devices to hinder analysis, and persistence mechanisms that can survive reboots, firmware upgrades, and software updates. In some cases, persistence has involved modification of the boot process and ROMmon-related behavior. Victimology indicates a focus on government-owned perimeter devices globally, with confirmed targeting of government and telecommunications networks and at least one U.S. government agency. The operation fits a broader pattern of state-backed espionage against edge devices that provide high-value access to protected networks. ArcaneDoor’s emphasis on stealthy access to network appliances, traffic visibility, and durable persistence distinguishes it as an advanced espionage-focused threat actor rather than a financially motivated or ransomware-oriented operation.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
45 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 malware families attributed to this actor across reporting.
5 CVEs this actor has used in observed campaigns. 5 of them exploited in the wild.
CVE-2025-20362 (CVSSv3.1 skóre 7,7) spočíva v nedostatočnom overovaní používateľských vstupov v rámci HTTP(S) požiadaviek s nedostatočnej implementácii mechanizmov autentifikácie. Vzdialený neautentifikovaný útočník by ju mohol zneužiť na obídenie mechanizmov autentifikácie a získanie prístupu k URL koncovým bodom, ktoré by mali byť prístupné len pre prihlásených používateľov. Zraniteľnosť je v súčasnosti aktívne zneužívaná.
CVE-2025-20333 (CVSSv3.1 skóre 9,9) sa nachádza v komponente VPN Web Server a spočíva v nedostatočnom overovaní používateľských vstupov v HTTP(S) požiadavkách. Vzdialený autentifikovaný útočník s platnými prihlasovacími údajmi VPN by zraniteľnosť zaslaním špeciálne vytvorených HTTP požiadaviek mohol zneužiť na vzdialené vykonanie kódu a získanie úplnej kontroly nad systémom. Zraniteľnosť je v súčasnosti aktívne zneužívaná.
Cisco upozornila na kampaň ArcaneDoor, v ktorej útočníci zneužívajú zero-day zraniteľnosť CVE-2024-20353 na firewalloch Cisco ASA a FTD. Zero-day zraniteľnosť v správe webových serverov a VPN umožňuje neautentifikovanému vzdialenému útočníkovi spôsobiť opätovné načítanie zariadenia, čo môže viesť k odmietnutiu služby (DoS).
Cisco uviedla, že CVE-2024-20359 je jednou z dvoch zero-day zraniteľností aktívne zneužívaných v kampani ArcaneDoor proti firewallom Cisco ASA a FTD. Zraniteľnosť funkcie prednahrania klientov VPN a modulov umožňuje autentifikovanému lokálnemu útočníkovi vykonať ľubovoľný kód s oprávneniami root.
The hackers are, reportedly, chaining together two known vulnerabilities in the Cisco ASA devices, identified as CVE-2025-30333 (CVSS 9.9) and CVE-2025-20362 (CVSS 6.5). This combined attack allows them to gain deep, persistent control over the appliances. CVE-2025-30333 is a serious issue that lets an attacker with VPN credentials run their own code on the device...
62 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A China-affiliated campaign linked to attacks against Cisco firewall and switch infrastructure using remote code execution and privilege escalation to gain persistent unauthorized access.
Associated with exploitation of Cisco ASA/FTD vulnerabilities to deploy the FIRESTARTER backdoor and LINE VIPER post-exploitation toolkit for persistent access to compromised network appliances.
Referenced as an example of a named activity cluster associated with exploiting edge devices to maintain persistent access into targeted networks.
State-sponsored cyber-espionage activity leveraging Cisco zero-day vulnerabilities.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.