Cisco ArcaneDoor 2024

Line Dancer can hook both the crash dump process and the Autehntication, Authorization, and Accounting (AAA) functions on compromised machines to evade forensic analysis and authentication mechanisms.

ArcaneDoor included hooking the `processHostScanReply()` function on victim Cisco ASA devices.

Line Runner uses a ZIP payload that is automatically extracted with its contents, a LUA script, executed for initial execution via CVE-2024-20359.

ArcaneDoor involved the use of digital certificates on adversary-controlled network infrastructure that mimicked the formatting used by legitimate Cisco ASA appliances.

ArcaneDoor used malicious boot scripts to install the Line Runner backdoor on victim devices.

ArcaneDoor included network packet capture and sniffing for data collection in victim environments.

Line Dancer can create and exfiltrate packet captures from compromised environments.

Line Runner utilizes HTTP to retrieve and exfiltrate information staged using Line Dancer.

ArcaneDoor included use of existing command and control channels for data exfiltration.

Line Dancer exfiltrates collected data via command and control channels.

ArcaneDoor included injecting code into the AAA and Crash Dump processes on infected Cisco ASA devices.

ArcaneDoor included the adversary executing command line interface (CLI) commands.

Line Dancer can execute native commands in networking device command line interfaces.

Line Runner utilizes Lua scripts for command execution.

ArcaneDoor included multiple instances of file deletion or removal during execution and other adversary actions.

Line Runner removes its initial ZIP delivery archive after processing the enclosed LUA script.

ArcaneDoor command and control activity was conducted through HTTP.

Line Runner utilizes an HTTP-based Lua backdoor on victim machines.

Line Dancer uses HTTP POST requests to interact with compromised devices.

Line Dancer can gather system configuration information by running the native `show configuration` command.

ArcaneDoor utilized HTTP command and control traffic where commands are intercepted from HTTP traffic to the device, parsed for appropriate identifiers and commands, and then executed.

ArcaneDoor involved the use of Base64 obfuscated scripts and commands.

ArcaneDoor included modification of the AAA process to bypass authentication mechanisms.

ArcaneDoor included interception of HTTP traffic to victim devices to identify and parse command and control information sent to the device.

Line Runner intercepts HTTP requests to the victim Cisco ASA, looking for a request with a 32-character, victim dependent parameter. If that parameter matches a value in the malware, a contained payload is then written to a Lua script and executed.

ArcaneDoor included the use of dedicated, adversary-controlled virtual private servers for command and control.

ArcaneDoor included the use of OpenConnect VPN Server instances for conducting actions on victim devices.

ArcaneDoor featured the development and deployment of two unique malware types, Line Dancer and Line Runner.

ArcaneDoor included acquiring digital certificates mimicking patterns associated with Cisco ASA appliances for command and control infrastructure.

Line Runner used CVE-2024-20353 to trigger victim devices to reboot, in the process unzipping and installing the Line Dancer payload.

ArcaneDoor involved exploitation of CVE-2024-20353 to force a victim Cisco ASA to reboot, triggering the automated unzipping and execution of the Line Runner implant.

Line Dancer can modify the crash dump process on infected machines to skip crash dump generation and proceed directly to device reboot for both persistence and forensic evasion purposes.

ArcaneDoor modified the Authentication, Authorization, and Accounting (AAA) function of targeted Cisco ASA appliances to allow the threat actor to bypass normal AAA operations.

ArcaneDoor included disabling logging on targeted Cisco ASA appliances.

Line Dancer can disable syslog on compromised devices.