Draft:ArcaneDoor

From Wikipedia, the free encyclopedia


ArcaneDoor is a cybercrime/cyberwarfare campaign involving state actors that targets network edge devices.[1][2][3][4][5] It has exploited a number of zero-day vulnerabilities in Cisco devices, including CVE-2024-2035 and CVE-2024-20359.[6]

It implants two malware tippers, Line Runner and Line Dancer, that target Cisco Adaptive Security Appliances and Firepower Threat Defense devices.[6][7][8][9]

References[edit]

  1. ^ Greenberg, Andy. "Cyberspies Hacked Cisco Firewalls to Access Government Networks". Wired. ISSN 1059-1028. Retrieved 2024-04-29.
  2. ^ Kundaliya, Dev (2024-04-26). "Global government networks breached in 'ArcaneDoor' espionage campaign". www.computing.co.uk. Retrieved 2024-04-29.
  3. ^ Lyons, Jessica. "'Sophisticated' nation-state crew exploiting Cisco firewalls". www.theregister.com. Retrieved 2024-04-29.
  4. ^ "ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices". Cisco Talos Blog. 2024-04-24. Retrieved 2024-04-28.
  5. ^ Coker, James (2024-04-25). "State-Sponsored Espionage Campaign Exploits Cisco Vulnerabilities". Infosecurity Magazine. Retrieved 2024-04-29.
  6. ^ a b "ArcaneDoor hackers exploit Cisco zero-days to breach govt networks". BleepingComputer. Retrieved 2024-04-28.
  7. ^ "Malware Tipper: Line Runner" (PDF). National Cyber Security Centre. 24 April 2024. Retrieved 2024-04-28.
  8. ^ "Malware Tipper: Line Dancer" (PDF). National Cyber Security Centre. 24 April 2024. Retrieved 2024-04-28.
  9. ^ Culafi, Alexander. "Cisco zero-day flaws in ASA, FTD software under attack". TechTarget. Retrieved 2024-04-28.