Procedure examples

ArcaneDoor included hooking the `processHostScanReply()` function on victim Cisco ASA devices.

ArcaneDoor included scripted exfiltration of collected data.

ArcaneDoor involved the use of digital certificates on adversary-controlled network infrastructure that mimicked the formatting used by legitimate Cisco ASA appliances.

ArcaneDoor used malicious boot scripts to install the Line Runner backdoor on victim devices.

ArcaneDoor included network packet capture and sniffing for data collection in victim environments.

ArcaneDoor included use of existing command and control channels for data exfiltration.

ArcaneDoor included injecting code into the AAA and Crash Dump processes on infected Cisco ASA devices.

ArcaneDoor included the adversary executing command line interface (CLI) commands.

ArcaneDoor included multiple instances of file deletion or removal during execution and other adversary actions.

ArcaneDoor command and control activity was conducted through HTTP.

ArcaneDoor included collection of victim device configuration information.

ArcaneDoor utilized HTTP command and control traffic where commands are intercepted from HTTP traffic to the device, parsed for appropriate identifiers and commands, and then executed.

ArcaneDoor included collection of packet capture and system configuration information.

ArcaneDoor used WebVPN sessions commonly associated with Clientless SSLVPN services to communicate to compromised devices.

ArcaneDoor involved the use of Base64 obfuscated scripts and commands.

ArcaneDoor abused WebVPN traffic to targeted devices to achieve unauthorized remote code execution.

ArcaneDoor included modification of the AAA process to bypass authentication mechanisms.

ArcaneDoor included interception of HTTP traffic to victim devices to identify and parse command and control information sent to the device.

ArcaneDoor included the use of dedicated, adversary-controlled virtual private servers for command and control.

ArcaneDoor included the use of OpenConnect VPN Server instances for conducting actions on victim devices.

ArcaneDoor featured the development and deployment of two unique malware types, Line Dancer and Line Runner.

ArcaneDoor included acquiring digital certificates mimicking patterns associated with Cisco ASA appliances for command and control infrastructure.

ArcaneDoor involved exploitation of CVE-2024-20353 to force a victim Cisco ASA to reboot, triggering the automated unzipping and execution of the Line Runner implant.

ArcaneDoor modified the Authentication, Authorization, and Accounting (AAA) function of targeted Cisco ASA appliances to allow the threat actor to bypass normal AAA operations.

ArcaneDoor included disabling logging on targeted Cisco ASA appliances.