{
  "modified": "2025-03-10T19:05:59.813Z",
  "name": "ArcaneDoor",
  "description": "[ArcaneDoor](https://attack.mitre.org/campaigns/C0046) is a campaign targeting networking devices from Cisco and other vendors between July 2023 and April 2024, primarily focused on government and critical infrastructure networks. [ArcaneDoor](https://attack.mitre.org/campaigns/C0046) is associated with the deployment of the custom backdoors [Line Runner](https://attack.mitre.org/software/S1188) and [Line Dancer](https://attack.mitre.org/software/S1186). [ArcaneDoor](https://attack.mitre.org/campaigns/C0046) is attributed to a group referred to as UAT4356 or STORM-1849, and is assessed to be a state-sponsored campaign.(Citation: Cisco ArcaneDoor 2024)(Citation: CCCS ArcaneDoor 2024)",
  "aliases": [
    "ArcaneDoor"
  ],
  "first_seen": "2023-07-01T06:00:00.000Z",
  "last_seen": "2024-04-01T06:00:00.000Z",
  "x_mitre_first_seen_citation": "(Citation: Cisco ArcaneDoor 2024)",
  "x_mitre_last_seen_citation": "(Citation: Cisco ArcaneDoor 2024)",
  "x_mitre_deprecated": false,
  "x_mitre_version": "1.0",
  "x_mitre_contributors": [
    "Jun Hirata, NEC Corporation",
    "Sareena Karapoola, NEC Corporation India",
    "Pooja Natarajan, NEC Corporation India"
  ],
  "type": "campaign",
  "spec_version": "2.1",
  "id": "campaign--a543ef15-91ea-4aa9-9c10-267d56e1ee82",
  "created": "2025-01-06T15:59:57.952Z",
  "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "revoked": false,
  "external_references": [
    {
      "source_name": "mitre-attack",
      "url": "https://attack.mitre.org/campaigns/C0046",
      "external_id": "C0046"
    },
    {
      "source_name": "CCCS ArcaneDoor 2024",
      "description": "Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.",
      "url": "https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns"
    },
    {
      "source_name": "Cisco ArcaneDoor 2024",
      "description": "Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.",
      "url": "https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/"
    }
  ],
  "object_marking_refs": [
    "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
  ],
  "x_mitre_attack_spec_version": "3.2.0",
  "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "x_mitre_domains": [
    "enterprise-attack"
  ]
}