ArcaneDoor Campaign (also known as ArcaneDoor, UAT4356, Storm-1849) is a campaign / breach active since 2024. Cisco ASA/FTD zero-day exploitation. Key characteristics include: Cisco ASA zero-days (CVE-2024-20353/20359), Line Dancer/Line Runner implants, state-sponsored espionage.
Overview & Background
Cisco ASA/FTD zero-day exploitation. First identified in 2024, this threat is attributed to China (suspected).
ArcaneDoor Campaign remains an active threat. Organizations should implement detection rules and monitor for indicators associated with this campaign / breach.
- Category: Campaign / Breach
- Active since: 2024
- Attribution: China (suspected)
- Also known as: ArcaneDoor, UAT4356, Storm-1849
Technical Analysis
ArcaneDoor Campaign employs the following capabilities and techniques:
- Cisco Asa Zero-Days (Cve-2024-20353/20359): Core functionality
- Line Dancer/Line Runner Implants: Core functionality
- State-Sponsored Espionage: Core functionality
MITRE ATT&CK Mapping
| Tactic | Technique | Usage |
|---|---|---|
| Initial Access | T1566.001 Phishing Attachment | Common delivery vector |
| Execution | T1204.002 Malicious File | User-triggered execution |
| Persistence | T1547.001 Registry Run Keys | Autostart persistence |
| Defense Evasion | T1027 Obfuscated Files | Payload obfuscation |
| C2 | T1071.001 Web Protocols | HTTP/HTTPS C2 |
Detection & Defense
- Endpoint detection: Deploy behavioral detection rules for ArcaneDoor Campaign indicators
- Network monitoring: Monitor for C2 traffic patterns and anomalous connections
- Threat intelligence: Track ArcaneDoor Campaign IOCs and campaign updates
- Security awareness: Train users to recognize phishing and social engineering
- Patch management: Keep systems updated to prevent exploitation
Defend Against ArcaneDoor Campaign
Mjolnir Security provides detection and response capabilities against ArcaneDoor Campaign and similar threats.
- Proactive Threat Hunting Hunt for ArcaneDoor Campaign indicators and TTPs within your environment.
- Threat Intelligence Monitor ArcaneDoor Campaign campaigns and infrastructure changes.
- 24/7 Incident Response Rapid containment and forensic investigation. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts