LiveActive security incident?Get immediate response
MITRE ATT&CK® Campaign

C0046: ArcaneDoor

ArcaneDoor is a campaign targeting networking devices from Cisco and other vendors between July 2023 and April 2024, primarily focused on government and critical infrastructure networks. ArcaneDoor is associated with the deployment of the custom backdoors Line Runner and Line Dancer. ArcaneDoor is attributed to a group referred to as UAT4356 or STORM-1849, and is assessed to be a state-sponsored campaign.[1][2]

EnterpriseC0046CampaignObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

ArcaneDoor matters because it shows how compromise of perimeter networking devices can become a business continuity and incident response problem, not just a malware issue. The campaign is described by ATT&CK as targeting Cisco and other networking devices, primarily in government and critical infrastructure networks, and using custom backdoors associated with execution of Lua scripts or shellcode. For leaders, the key question is whether edge devices are inventoried, monitored, recoverable, and included in incident response evidence collection.

Executive priority

Prioritize this as an edge-device resilience and visibility issue. Network devices often sit outside normal endpoint detection coverage, yet they can affect remote access, traffic visibility, credential exposure, and continuity of critical services. Executives should ask for evidence that public-facing network appliances, VPNs, and management interfaces are known, patched or risk-accepted, logged centrally, and covered by response playbooks that include firmware/configuration validation and replacement criteria.

Technical view

ATT&CK provides no campaign-specific detection text, so defenders should validate coverage against the related behaviors: exploitation of public-facing systems and external remote services; web-protocol command and control; automated collection and exfiltration; network sniffing and adversary-in-the-middle positioning; persistence through initialization scripts or authentication-process modification; stealth through masquerading, file deletion, deobfuscation, process injection, and rootkit-like behavior. Because the associated Line Runner and Line Dancer software are described for Network Devices, SOC and IR teams should confirm they can collect and preserve appliance logs, configuration snapshots, management-plane activity, network flow, TLS/certificate observations, and outbound web traffic from perimeter devices.

Likely telemetry

  • Network device system, audit, authentication, and administrative logs
  • VPN and external remote service access logs
  • Configuration and startup/boot script change records
  • Firmware, image, and file integrity evidence where available
  • Management-plane access records and command history where available

Detection direction

  • Validate that network devices are treated as monitored assets, not just infrastructure, with logs forwarded and retained before an incident occurs.
  • Hunt for unusual management access, unexpected configuration changes, new or altered initialization scripts, and authentication-process changes on perimeter devices.
  • Review outbound web-protocol traffic from networking devices, especially where those devices normally should not initiate broad external communications.
  • Correlate automated collection or exfiltration indicators with network flows rather than relying only on endpoint telemetry.
  • Account for stealth behaviors such as masquerading and file deletion by comparing device state against known-good configurations and backups.

Mitigation priorities

  • Maintain a current inventory of Internet-facing networking devices, VPNs, and management interfaces, including ownership and criticality.
  • Restrict and monitor administrative access to network devices; separate management planes from general user networks where feasible.
  • Prioritize timely remediation and risk acceptance tracking for weaknesses in public-facing network appliances and remote services.
  • Centralize logs from network devices and test that SOC and IR teams can retrieve them during an incident.
  • Back up known-good configurations and define recovery procedures for rebuilding or replacing compromised edge devices.
Additional notes and limits

This Glexia take is based on the ATT&CK campaign object for ArcaneDoor, its official description, external references, and listed relationships to Line Runner, Line Dancer, and related techniques. The strongest defensive theme is perimeter network device readiness: visibility, configuration assurance, remote access governance, and IR recoverability.

ATT&CK does not provide platform or tactic values directly on the ArcaneDoor campaign object and does not include official detection guidance. Technique and software relationships provide useful defensive context, but local device models, firmware versions, logging capabilities, network architecture, and business criticality are required to determine actual exposure or coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

ArcaneDoor

ArcaneDoor is a campaign targeting networking devices from Cisco and other vendors between July 2023 and April 2024, primarily focused on government and critical infrastructure networks. ArcaneDoor is associated with the deployment of the custom backdoors Line Runner and Line Dancer. ArcaneDoor is attributed to a group referred to as UAT4356 or STORM-1849, and is assessed to be a state-sponsored campaign.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

25 rows
DomainIDNameRelationship / procedure
EnterpriseT1102.003One-Way CommunicationSub-technique

ArcaneDoor utilized HTTP command and control traffic where commands are intercepted from HTTP traffic to the device, parsed for appropriate identifiers and commands, and then executed.[1]

EnterpriseT1037Boot or Logon Initialization Scripts

ArcaneDoor used malicious boot scripts to install the Line Runner backdoor on victim devices.[1]

EnterpriseT1036Masquerading

ArcaneDoor involved the use of digital certificates on adversary-controlled network infrastructure that mimicked the formatting used by legitimate Cisco ASA appliances.[1]

EnterpriseT1583.003Virtual Private ServerSub-technique

ArcaneDoor included the use of dedicated, adversary-controlled virtual private servers for command and control.[1]

EnterpriseT1041Exfiltration Over C2 Channel

ArcaneDoor included use of existing command and control channels for data exfiltration.[1][2]

EnterpriseT1587.003Digital CertificatesSub-technique

ArcaneDoor included acquiring digital certificates mimicking patterns associated with Cisco ASA appliances for command and control infrastructure.[1]

EnterpriseT1653Power Settings

ArcaneDoor involved exploitation of CVE-2024-20353 to force a victim Cisco ASA to reboot, triggering the automated unzipping and execution of the Line Runner implant.[1]

EnterpriseT1583.006Web ServicesSub-technique

ArcaneDoor included the use of OpenConnect VPN Server instances for conducting actions on victim devices.[1]

EnterpriseT1020Automated Exfiltration

ArcaneDoor included scripted exfiltration of collected data.[2]

EnterpriseT1557Adversary-in-the-Middle

ArcaneDoor included interception of HTTP traffic to victim devices to identify and parse command and control information sent to the device.[1]

EnterpriseT1587.001MalwareSub-technique

ArcaneDoor featured the development and deployment of two unique malware types, Line Dancer and Line Runner.[2][1]

EnterpriseT1119Automated Collection

ArcaneDoor included collection of packet capture and system configuration information.[2]

EnterpriseT1014Rootkit

ArcaneDoor included hooking the `processHostScanReply()` function on victim Cisco ASA devices.[1]

EnterpriseT1556Modify Authentication Process

ArcaneDoor included modification of the AAA process to bypass authentication mechanisms.[1]

EnterpriseT1040Network Sniffing

ArcaneDoor included network packet capture and sniffing for data collection in victim environments.[1][2]

EnterpriseT1070.004File DeletionSub-technique

ArcaneDoor included multiple instances of file deletion or removal during execution and other adversary actions.[1][2]

EnterpriseT1059Command and Scripting Interpreter

ArcaneDoor included the adversary executing command line interface (CLI) commands.[1]

EnterpriseT1690Prevent Command History Logging

ArcaneDoor included disabling logging on targeted Cisco ASA appliances.[1][2]

EnterpriseT1685Disable or Modify Tools

ArcaneDoor modified the Authentication, Authorization, and Accounting (AAA) function of targeted Cisco ASA appliances to allow the threat actor to bypass normal AAA operations.[1][2]

EnterpriseT1190Exploit Public-Facing Application

ArcaneDoor abused WebVPN traffic to targeted devices to achieve unauthorized remote code execution.[2]

EnterpriseT1082System Information Discovery

ArcaneDoor included collection of victim device configuration information.[2]

EnterpriseT1071.001Web ProtocolsSub-technique

ArcaneDoor command and control activity was conducted through HTTP.[1]

EnterpriseT1133External Remote Services

ArcaneDoor used WebVPN sessions commonly associated with Clientless SSLVPN services to communicate to compromised devices.[2]

EnterpriseT1055Process Injection

ArcaneDoor included injecting code into the AAA and Crash Dump processes on infected Cisco ASA devices.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

ArcaneDoor involved the use of Base64 obfuscated scripts and commands.[1]

Associated objects

Groups, software, and campaigns

Relationship explorer

All related ATT&CK context

uses · TechniqueT1102.003: One-Way CommunicationEnterpriseuses · TechniqueT1037: Boot or Logon Initialization ScriptsEnterpriseuses · MalwareS1186: Line DancerEnterpriseuses · TechniqueT1036: MasqueradingEnterpriseuses · MalwareS1188: Line RunnerEnterpriseuses · TechniqueT1583.003: Virtual Private ServerEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1587.003: Digital CertificatesEnterpriseuses · TechniqueT1653: Power SettingsEnterpriseuses · TechniqueT1583.006: Web ServicesEnterpriseuses · TechniqueT1020: Automated ExfiltrationEnterpriseuses · TechniqueT1557: Adversary-in-the-MiddleEnterpriseuses · TechniqueT1587.001: MalwareEnterpriseuses · TechniqueT1119: Automated CollectionEnterpriseuses · TechniqueT1014: RootkitEnterpriseuses · TechniqueT1556: Modify Authentication ProcessEnterpriseuses · TechniqueT1040: Network SniffingEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1059: Command and Scripting InterpreterEnterpriseuses · TechniqueT1690: Prevent Command History LoggingEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · TechniqueT1190: Exploit Public-Facing ApplicationEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
03554bf3f7c756f7...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle03554bf3f7c7…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  2. [2]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  3. [3]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  4. [4]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  5. [5]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  6. [6]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  7. [7]
    mitre-attackC0046
    Open source URL
  8. [8]
    mitre-attackC0046
    Open source URL
  9. [9]
    mitre-attackC0046
    Open source URL
  10. [10]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  11. [11]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  12. [12]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  13. [13]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  14. [14]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  15. [15]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  16. [16]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  17. [17]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  18. [18]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  19. [19]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  20. [20]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  21. [21]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  22. [22]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  23. [23]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  24. [24]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  25. [25]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  26. [26]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  27. [27]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  28. [28]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  29. [29]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  30. [30]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  31. [31]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  32. [32]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  33. [33]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  34. [34]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  35. [35]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  36. [36]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  37. [37]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  38. [38]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  39. [39]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  40. [40]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  41. [41]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  42. [42]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  43. [43]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  44. [44]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  45. [45]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  46. [46]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  47. [47]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  48. [48]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  49. [49]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  50. [50]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  51. [51]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  52. [52]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  53. [53]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  54. [54]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  55. [55]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  56. [56]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  57. [57]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  58. [58]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  59. [59]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  60. [60]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  61. [61]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  62. [62]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  63. [63]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  64. [64]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  65. [65]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  66. [66]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  67. [67]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  68. [68]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  69. [69]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  70. [70]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  71. [71]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  72. [72]
    CCCS ArcaneDoor 2024

    Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025.

    Open source URL
  73. [73]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
  74. [74]
    Cisco ArcaneDoor 2024

    Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use