Arcane Door - New espionage-focused campaign found targeting perimeter network devices

Summary: Cisco Talos identified a state-sponsored campaign it tracks as UAT4356 (Microsoft calls it STORM-1849) that targeted Cisco ASA devices with two backdoors, Line Runner and Line Dancer, abusing CVE-2024-20353 and CVE-2024-20359. The actor's infrastructure dates to early November 2023, with most activity between December 2023 and early January 2024, and victims were government networks globally; a September 2025 update tied new ASA 5500-X activity to the same actor under CVE-2025-20333, CVE-2025-20362 and CVE-2025-20363.
Bottom line: The initial access vector was never determined, so there is no known signature to block at the front door - and Line Runner survives reboots and software upgrades, meaning a device can look patched and still be compromised.

Read the original at Cisco Talos ↗

Topics: Threat Actors & Nation-State
Mentions: CVE-2024-20353 CVE-2024-20359 CVE-2025-20333 CVE-2025-20362 CVE-2025-20363
Related: Threat Insights: Active Exploitation of Cisco ASA Zero Days Cyber Risks ·
UAT-4356's Targeting of Cisco Firepower Devices Cyber Risks ·
25,000 IPs Scanned Cisco ASA Devices — New Vulnerability Potentially Incoming Cyber Risks ·