Loading story…
A state-sponsored espionage campaign dubbed ArcaneDoor targeted internet-facing Cisco ASA and FTD appliances, with activity observed from 2023 and victim compromises identified in early 2024. Cisco, allied cyber agencies, and researchers said the attackers focused on perimeter devices including ASA55xx systems, exploiting flaws in WebVPN and related exposed services to gain remote access and deploy two malware components: Line Runner, a persistent Lua-based webshell, and Line Dancer, a memory-resident shellcode loader. The operation enabled reconnaissance, configuration changes, traffic capture, data exfiltration, and potential lateral movement from trusted network edge infrastructure.
Authorities linked the activity to an advanced threat actor tracked as UAT4356 by Cisco and STORM-1849 by Microsoft, and warned that affected devices included systems running vulnerable firmware such as 9.12 and 9.14. Public guidance highlighted patched vulnerabilities including CVE-2024-20359 and CVE-2024-20353, while the UK NCSC detailed how Line Dancer hijacks WebVPN XML parsing through the <host-scan-reply> field and executes attacker-supplied shellcode entirely in memory. Defenders were urged to patch exposed devices, inspect for indicators of compromise before rebooting because Line Dancer is non-persistent, and use released detection content including behavioral checks, SNORT coverage, and YARA rules.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
On 2024-04-24, the UK NCSC issued a Malware Tipper report for Line Dancer. The report documented the implant's in-memory behavior, detection guidance, and a YARA rule to help defenders identify the malware on Cisco ASA devices.
On 2024-04-24, Cisco and allied cyber agencies disclosed active exploitation tied to the ArcaneDoor campaign affecting Cisco ASA and FTD devices. The disclosures identified exploited vulnerabilities, described the espionage-focused activity, and urged defenders to patch and investigate for compromise.
A joint advisory said that since early 2024, a sophisticated state-sponsored actor had been targeting Cisco ASA VPN devices, particularly ASA55xx systems running firmware 9.12 and 9.14. The attackers exploited WebVPN services to gain access and conduct espionage-focused operations.
Cisco observed the first ArcaneDoor activity toward victim Cisco ASA devices in January 2024. The campaign was later assessed as a targeted espionage operation using the Line Runner and Line Dancer backdoors.
Cisco reported observations of infrastructure linked to the ArcaneDoor threat actor in November 2023, with related infrastructure potentially dating back as early as July 2023. This indicates campaign preparation before victim activity was observed.
The UK NCSC reported that Line Dancer was identified being deployed to Cisco ASA devices during cyber-attacks observed in late 2023 and early 2024. The malware is an in-memory shellcode loader later associated with the broader ArcaneDoor activity.
Cisco released patched firmware versions 9.16.4.57, 9.18.4.22, and 9.20.2.10 to address vulnerabilities exploited in the campaign, including CVE-2024-20359 and CVE-2024-20353. Defenders were advised to upgrade, disable WebVPN if patching was not possible, and monitor for indicators of compromise.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
mnemonic.io
Open sourcecymulate.com
Open sourcecyber.gc.ca
Open sourceblog.talosintelligence.com
Open sourcencsc.gov.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed **ArcaneDoor**, a large-scale campaign targeting **Cisco ASA** and **Cisco Firepower Threat Defense (FTD)** devices through two actively exploited zero-day vulnerabilities, `CVE-2024-20353` and `CVE-2024-20359`. The company said the activity was linked to threat actor **UAT4356**, also tracked as **Storm-1849**, which used the **Line Runner** and **Line Dancer** backdoors to gain persistent access to perimeter firewalls. The intrusions allowed attackers to monitor network traffic, execute malicious code, and collect sensitive information from compromised devices. Cisco also patched `CVE-2024-20358`, a related flaw that can enable root-level command injection, and warned that the affected vulnerabilities could lead to denial of service, arbitrary code execution, and information disclosure. Customers were urged to apply updates immediately and validate device integrity as part of incident response.
Jul 23, 2026
Cisco confirmed that attackers have been actively exploiting two zero-day vulnerabilities, CVE-2025-20333 and CVE-2025-20362, in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. These vulnerabilities allow attackers to execute arbitrary code as root and access restricted URLs without authentication, leading to device reloads and denial-of-service (DoS) conditions. The U.K. National Cyber Security Centre (NCSC) and Cisco have linked these exploits to malware campaigns involving RayInitiator and LINE VIPER, and have urged immediate patching. Security advisories highlight that unpatched devices are at risk of persistent compromise, and recommend comprehensive remediation steps including patching, forensic analysis, and resetting credentials. Threat intelligence reports attribute the exploitation campaign to the China-linked group Storm-1849 (ArcaneDoor), which targeted U.S. financial institutions, defense contractors, and military organizations throughout October. Despite public disclosure and patch directives from CISA, attacks continued, demonstrating the attackers' operational sophistication and persistence. Experts warn that organizations running unpatched ASA devices should assume compromise and prioritize forensic hunting for ROM-level malware, as well as implement robust monitoring and maintenance practices to mitigate ongoing risks.
Jun 29, 2026
Cisco confirmed that multiple government agencies engaged its incident response teams in May 2025 to investigate targeted attacks against Cisco Adaptive Security Appliance (ASA) 5500-X Series devices running Cisco Secure Firewall ASA Software with VPN web services enabled. Attackers exploited multiple zero-day vulnerabilities to implant malware, execute commands, and potentially exfiltrate data from compromised devices. The threat actor demonstrated advanced evasion techniques, including disabling logging, intercepting CLI commands, and intentionally crashing devices to hinder forensic analysis. Cisco’s investigation, which involved providing instrumented images and analyzing packet captures and firmware, led to the identification of a critical memory corruption bug in the ASA software. The company assessed with high confidence that the activity was linked to the same threat actor behind the ArcaneDoor campaign previously reported in 2024. While the vulnerable software is present on other hardware platforms and in Cisco Secure Firewall Threat Defense (FTD) Software, there is no evidence of successful compromise beyond the ASA 5500-X Series. Cisco published detailed detection guidance, highlighting that the threat actor continues to scan for vulnerable devices using frequently changing IP addresses, and that scanning activity alone does not indicate compromise. Only specific ASA 5500-X models running certain software releases with VPN web services enabled have been confirmed as compromised. The threat actor suppressed specific syslog messages in memory as a forensic countermeasure, and a downward shift in these logs may indicate malicious activity. On September 25, 2025, Cisco released security advisories addressing critical vulnerabilities, including CVE-2025-20333, CVE-2025-20362, and CVE-2025-20363, affecting a range of ASA and FTD software versions. The Canadian Centre for Cyber Security issued alerts urging organizations to review Cisco’s advisories, apply mitigations, and update affected devices. The vulnerabilities allow for remote code execution and unauthorized access via VPN web services and HTTP servers on affected firewall products. Cisco’s advisories provided a comprehensive list of affected software versions and recommended immediate action to mitigate risk. The incident underscores the sophistication of the threat actor, the importance of timely patching, and the need for enhanced monitoring of VPN-enabled firewall devices. Cisco’s response included collaboration with affected customers, deployment of enhanced detection capabilities, and ongoing monitoring for further malicious activity. Organizations are advised to follow Cisco’s guidance, monitor for suppressed syslog IDs, and engage Cisco Technical Assistance Center if compromise is suspected. The campaign highlights the persistent targeting of network edge devices by advanced threat actors and the criticality of maintaining up-to-date security controls.
Aug 31, 2026