1. Home
  2. Campaigns
  3. ArcaneDoor

ArcaneDoor

ArcaneDoor is a campaign targeting networking devices from Cisco and other vendors between July 2023 and April 2024, primarily focused on government and critical infrastructure networks. ArcaneDoor is associated with the deployment of the custom backdoors Line Runner and Line Dancer. ArcaneDoor is attributed to a group referred to as UAT4356 or STORM-1849, and is assessed to be a state-sponsored campaign.[1][2]

ID: C0046
First Seen:  July 2023 [1]
Last Seen:  April 2024 [1]
Contributors: Jun Hirata, NEC Corporation; Sareena Karapoola, NEC Corporation India; Pooja Natarajan, NEC Corporation India
Version: 1.0
Created: 06 January 2025
Last Modified: 10 March 2025
Version Permalink
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1583 .003 Acquire Infrastructure: Virtual Private Server

ArcaneDoor included the use of dedicated, adversary-controlled virtual private servers for command and control.[1]
.006 Acquire Infrastructure: Web Services

ArcaneDoor included the use of OpenConnect VPN Server instances for conducting actions on victim devices.[1]
Enterprise T1557 Adversary-in-the-Middle

ArcaneDoor included interception of HTTP traffic to victim devices to identify and parse command and control information sent to the device.[1]
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

ArcaneDoor command and control activity was conducted through HTTP.[1]
Enterprise T1119 Automated Collection

ArcaneDoor included collection of packet capture and system configuration information.[2]
Enterprise T1020 Automated Exfiltration

ArcaneDoor included scripted exfiltration of collected data.[2]
Enterprise T1037 Boot or Logon Initialization Scripts

ArcaneDoor used malicious boot scripts to install the Line Runner backdoor on victim devices.[1]
Enterprise T1059 Command and Scripting Interpreter

ArcaneDoor included the adversary executing command line interface (CLI) commands.[1]
Enterprise T1140 Deobfuscate/Decode Files or Information

ArcaneDoor involved the use of Base64 obfuscated scripts and commands.[1]
Enterprise T1587 .001 Develop Capabilities: Malware

ArcaneDoor featured the development and deployment of two unique malware types, Line Dancer and Line Runner.[2][1]
.003 Develop Capabilities: Digital Certificates

ArcaneDoor included acquiring digital certificates mimicking patterns associated with Cisco ASA appliances for command and control infrastructure.[1]
Enterprise T1041 Exfiltration Over C2 Channel

ArcaneDoor included use of existing command and control channels for data exfiltration.[1][2]
Enterprise T1190 Exploit Public-Facing Application

ArcaneDoor abused WebVPN traffic to targeted devices to achieve unauthorized remote code execution.[2]
Enterprise T1133 External Remote Services

ArcaneDoor used WebVPN sessions commonly associated with Clientless SSLVPN services to communicate to compromised devices.[2]
Enterprise T1562 .001 Impair Defenses: Disable or Modify Tools

ArcaneDoor modified the Authentication, Authorization, and Accounting (AAA) function of targeted Cisco ASA appliances to allow the threat actor to bypass normal AAA operations.[1][2]
.003 Impair Defenses: Impair Command History Logging

ArcaneDoor included disabling logging on targeted Cisco ASA appliances.[1][2]
Enterprise T1070 .004 Indicator Removal: File Deletion

ArcaneDoor included multiple instances of file deletion or removal during execution and other adversary actions.[1][2]
Enterprise T1036 Masquerading

ArcaneDoor involved the use of digital certificates on adversary-controlled network infrastructure that mimicked the formatting used by legitimate Cisco ASA appliances.[1]
Enterprise T1556 Modify Authentication Process

ArcaneDoor included modification of the AAA process to bypass authentication mechanisms.[1]
Enterprise T1040 Network Sniffing

ArcaneDoor included network packet capture and sniffing for data collection in victim environments.[1][2]
Enterprise T1653 Power Settings

ArcaneDoor involved exploitation of CVE-2024-20353 to force a victim Cisco ASA to reboot, triggering the automated unzipping and execution of the Line Runner implant.[1]
Enterprise T1055 Process Injection

ArcaneDoor included injecting code into the AAA and Crash Dump processes on infected Cisco ASA devices.[1]
Enterprise T1014 Rootkit

ArcaneDoor included hooking the processHostScanReply() function on victim Cisco ASA devices.[1]
Enterprise T1082 System Information Discovery

ArcaneDoor included collection of victim device configuration information.[2]
Enterprise T1102 .003 Web Service: One-Way Communication

ArcaneDoor utilized HTTP command and control traffic where commands are intercepted from HTTP traffic to the device, parsed for appropriate identifiers and commands, and then executed.[1]

Software

ID Name Description
S1186 Line Dancer

Line Dancer is uniquely associated with the ArcaneDoor campaign.[2][1]
S1188 Line Runner

Line Runner was used during the ArcaneDoor campaign.[2][1]

References

  1. Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.
  1. Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.