Threat Research · blog.talosintelligence.com

Cisco Details ArcaneDoor Espionage Campaign Targeting Perimeter Devices

Apr 24, 2024 · Original article ↗

Summary

Cisco Talos details ArcaneDoor, a state-sponsored espionage campaign targeting network perimeter devices, including Cisco ASA appliances. Attackers used Line Dancer and Line Runner backdoors; Cisco advises patching affected devices and provides detection guidance.

Key points

Talos attributes the activity with high confidence to a state-sponsored actor tracked as UAT4356 and Microsoft-tracked as STORM-1849; identified victims included government networks globally.
The campaign used two backdoors: memory-resident Line Dancer for command execution and data collection, and persistent Line Runner, which survived reboots and upgrades.
Observed actions included modifying configurations, capturing and exfiltrating network traffic, disabling logs, bypassing AAA authentication, and interfering with crash dumps to hinder forensics.
Cisco identified CVE-2024-20353 and CVE-2024-20359 as abused in the campaign and released patches; the initial access vector remains unknown.
Talos recommends upgrading to fixed software, checking devices for indicators such as unexpected ZIP files and anomalous executable memory regions, and using its published Snort signatures and IOC list.

Article Details

Attack Vectors: The initial access vector is unknown; Cisco reported no evidence of pre-authentication exploitation to date.
UAT4356 abused CVE-2024-20359 to install Line Runner through the ASA's legacy VPN client/plugin preloading functionality, and in at least one case abused CVE-2024-20353 to reboot the device and trigger installation.
On compromised Cisco ASA devices, Line Dancer intercepted shellcode submitted via the host-scan-reply field, allowing unauthenticated POST requests to interact with the implant without using traditional management interfaces.
Line Runner maintained persistence through a modified HTTP-based Lua backdoor that survived reboots and upgrades.
Defensive Notes: Upgrade affected devices to fixed software and follow Cisco's security advisories.
Keep perimeter devices patched, use up-to-date hardware, software and configurations, centralize logging, and configure strong multi-factor authentication.
Review disk0: for newly appearing or unusual ZIP files, including client_bundle_install.zip, and use the article's Line Runner detection and removal procedures.
Investigate unexpected gaps in logging, device reboots, and ASA memory-region output showing more than one executable region, especially a region exactly 0x1000 bytes.
Do not collect a core dump or reboot a suspected compromised device when the lina memory-region output indicates compromise; follow Cisco ASA forensic procedures through collection of the memory text section.
Use Snort signatures 63139, 62949, and 45575 to detect related activity; TLS decryption is required for these signatures to be effective.

Indicators of compromise

Type	Indicator	Context
IPV4	`103[.]114[.]200[.]230`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`103[.]119[.]3[.]230`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`103[.]125[.]218[.]198`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`103[.]20[.]222[.]218`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`103[.]27[.]132[.]69`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`103[.]51[.]140[.]101`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`104[.]156[.]232[.]22`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`107[.]148[.]19[.]88`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`107[.]172[.]16[.]208`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`107[.]173[.]140[.]111`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`121[.]227[.]168[.]69`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`121[.]37[.]174[.]139`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`131[.]196[.]252[.]148`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`139[.]162[.]135[.]12`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`149[.]28[.]166[.]244`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`152[.]70[.]83[.]47`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`154[.]22[.]235[.]13`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`154[.]22[.]235[.]17`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`154[.]39[.]142[.]47`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`172[.]105[.]90[.]154`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`172[.]105[.]94[.]93`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`172[.]233[.]245[.]241`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`176[.]31[.]18[.]153`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`185[.]123[.]101[.]250`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`185[.]167[.]60[.]85`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`185[.]227[.]111[.]17`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`185[.]244[.]210[.]120`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`185[.]244[.]210[.]65`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`192[.]210[.]137[.]35`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`192[.]36[.]57[.]181`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`194[.]32[.]78[.]183`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`194[.]4[.]49[.]6`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`205[.]234[.]232[.]196`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`207[.]148[.]74[.]250`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`212[.]193[.]2[.]48`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`213[.]156[.]138[.]68`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`213[.]156[.]138[.]77`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`213[.]156[.]138[.]78`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`216[.]155[.]157[.]136`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`216[.]238[.]66[.]251`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`216[.]238[.]71[.]49`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`216[.]238[.]72[.]201`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`216[.]238[.]74[.]95`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`216[.]238[.]75[.]155`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`216[.]238[.]81[.]149`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`216[.]238[.]85[.]220`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`216[.]238[.]86[.]24`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`45[.]128[.]134[.]189`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`45[.]63[.]119[.]131`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`45[.]76[.]118[.]87`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`45[.]77[.]52[.]253`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`45[.]77[.]54[.]14`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`45[.]86[.]163[.]224`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`45[.]86[.]163[.]244`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`5[.]183[.]95[.]95`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`51[.]15[.]145[.]37`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`89[.]44[.]198[.]16`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.
IPV4	`89[.]44[.]198[.]189`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`89[.]44[.]198[.]196`	Listed as likely actor-controlled infrastructure used by UAT4356.
IPV4	`96[.]44[.]159[.]46`	Listed as multi-tenant infrastructure associated with the operation; the article does not say it was directly controlled by the actor.