ArcaneDoor

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. ArcaneDoor is a campaign targeting networking devices from Cisco and other vendors between July 2023 and April 2024, primarily focused on government and critical infrastructure networks. ArcaneDoor is associated with the deployment of the custom backdoors Line Runner and Line Dancer. ArcaneDoor is attributed to a group referred to as UAT4356 or STORM-1849, and is assessed to be a state-sponsored campaign.(Citation: Cisco ArcaneDoor 2024)(Citation: CCCS ArcaneDoor 2024)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2023-07-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2023-07-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2024-04-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1102.003 · One-Way Communication

  Command And Control — ArcaneDoor utilized HTTP command and control traffic where commands are intercepted from HTTP traffic to the device, parsed for appropriate identifiers and commands, and then executed.(Citation: Cisco ArcaneDoor 2024)

• T1037 · Boot or Logon Initialization Scripts

  Persistence, Privilege Escalation — ArcaneDoor used malicious boot scripts to install the Line Runner backdoor on victim devices.(Citation: Cisco ArcaneDoor 2024)

• T1036 · Masquerading

  Stealth — ArcaneDoor involved the use of digital certificates on adversary-controlled network infrastructure that mimicked the formatting used by legitimate Cisco ASA appliances.(Citation: Cisco ArcaneDoor 2024)

• T1583.003 · Virtual Private Server

  Resource Development — ArcaneDoor included the use of dedicated, adversary-controlled virtual private servers for command and control.(Citation: Cisco ArcaneDoor 2024)

• T1041 · Exfiltration Over C2 Channel

  Exfiltration — ArcaneDoor included use of existing command and control channels for data exfiltration.(Citation: Cisco ArcaneDoor 2024)(Citation: CCCS ArcaneDoor 2024)

• T1587.003 · Digital Certificates

  Resource Development — ArcaneDoor included acquiring digital certificates mimicking patterns associated with Cisco ASA appliances for command and control infrastructure.(Citation: Cisco ArcaneDoor 2024)

• T1653 · Power Settings

  Persistence — ArcaneDoor involved exploitation of CVE-2024-20353 to force a victim Cisco ASA to reboot, triggering the automated unzipping and execution of the Line Runner implant.(Citation: Cisco ArcaneDoor 2024)

• T1583.006 · Web Services

  Resource Development — ArcaneDoor included the use of OpenConnect VPN Server instances for conducting actions on victim devices.(Citation: Cisco ArcaneDoor 2024)

• T1020 · Automated Exfiltration

  Exfiltration — ArcaneDoor included scripted exfiltration of collected data.(Citation: CCCS ArcaneDoor 2024)

• T1557 · Adversary-in-the-Middle

  Credential Access, Collection — ArcaneDoor included interception of HTTP traffic to victim devices to identify and parse command and control information sent to the device.(Citation: Cisco ArcaneDoor 2024)

• T1587.001 · Malware

  Resource Development — ArcaneDoor featured the development and deployment of two unique malware types, Line Dancer and Line Runner.(Citation: CCCS ArcaneDoor 2024)(Citation: Cisco ArcaneDoor 2024)

• T1119 · Automated Collection

  Collection — ArcaneDoor included collection of packet capture and system configuration information.(Citation: CCCS ArcaneDoor 2024)

• T1014 · Rootkit

  Stealth — ArcaneDoor included hooking the `processHostScanReply()` function on victim Cisco ASA devices.(Citation: Cisco ArcaneDoor 2024)

• T1556 · Modify Authentication Process

  Defense Impairment, Persistence, Credential Access — ArcaneDoor included modification of the AAA process to bypass authentication mechanisms.(Citation: Cisco ArcaneDoor 2024)

• T1040 · Network Sniffing

  Credential Access, Discovery — ArcaneDoor included network packet capture and sniffing for data collection in victim environments.(Citation: Cisco ArcaneDoor 2024)(Citation: CCCS ArcaneDoor 2024)

• T1070.004 · File Deletion

  Stealth — ArcaneDoor included multiple instances of file deletion or removal during execution and other adversary actions.(Citation: Cisco ArcaneDoor 2024)(Citation: CCCS ArcaneDoor 2024)

• T1059 · Command and Scripting Interpreter

  Execution — ArcaneDoor included the adversary executing command line interface (CLI) commands.(Citation: Cisco ArcaneDoor 2024)

• T1690 · Prevent Command History Logging

  Defense Impairment — ArcaneDoor included disabling logging on targeted Cisco ASA appliances.(Citation: Cisco ArcaneDoor 2024)(Citation: CCCS ArcaneDoor 2024)

• T1685 · Disable or Modify Tools

  Defense Impairment — ArcaneDoor modified the Authentication, Authorization, and Accounting (AAA) function of targeted Cisco ASA appliances to allow the threat actor to bypass normal AAA operations.(Citation: Cisco ArcaneDoor 2024)(Citation: CCCS ArcaneDoor 2024)

• T1190 · Exploit Public-Facing Application

  Initial Access — ArcaneDoor abused WebVPN traffic to targeted devices to achieve unauthorized remote code execution.(Citation: CCCS ArcaneDoor 2024)

• T1082 · System Information Discovery

  Discovery — ArcaneDoor included collection of victim device configuration information.(Citation: CCCS ArcaneDoor 2024)

• T1071.001 · Web Protocols

  Command And Control — ArcaneDoor command and control activity was conducted through HTTP.(Citation: Cisco ArcaneDoor 2024)

• T1133 · External Remote Services

  Persistence, Initial Access — ArcaneDoor used WebVPN sessions commonly associated with Clientless SSLVPN services to communicate to compromised devices.(Citation: CCCS ArcaneDoor 2024)

• T1055 · Process Injection

  Stealth, Privilege Escalation — ArcaneDoor included injecting code into the AAA and Crash Dump processes on infected Cisco ASA devices.(Citation: Cisco ArcaneDoor 2024)

• T1140 · Deobfuscate/Decode Files or Information

  Stealth — ArcaneDoor involved the use of Base64 obfuscated scripts and commands.(Citation: Cisco ArcaneDoor 2024)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0046

  Official MITRE ATT&CK campaign record C0046. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.