CCCS ArcaneDoor 2024

ArcaneDoor included scripted exfiltration of collected data.

ArcaneDoor included network packet capture and sniffing for data collection in victim environments.

ArcaneDoor included use of existing command and control channels for data exfiltration.

Line Dancer can execute native commands in networking device command line interfaces.

Line Runner utilizes Lua scripts for command execution.

ArcaneDoor included multiple instances of file deletion or removal during execution and other adversary actions.

Line Dancer uses HTTP POST requests to interact with compromised devices.

Line Runner utilizes an HTTP-based Lua backdoor on victim machines.

ArcaneDoor included collection of victim device configuration information.

ArcaneDoor included collection of packet capture and system configuration information.

ArcaneDoor used WebVPN sessions commonly associated with Clientless SSLVPN services to communicate to compromised devices.

Line Dancer shellcode payloads are base64 encoded when transmitted to compromised devices.

ArcaneDoor abused WebVPN traffic to targeted devices to achieve unauthorized remote code execution.

Line Runner is a persistent Lua-based web shell.

ArcaneDoor featured the development and deployment of two unique malware types, Line Dancer and Line Runner.

ArcaneDoor modified the Authentication, Authorization, and Accounting (AAA) function of targeted Cisco ASA appliances to allow the threat actor to bypass normal AAA operations.

ArcaneDoor included disabling logging on targeted Cisco ASA appliances.