Loading malware…
Line Runner is a persistent Lua-based web shell used in the ArcaneDoor espionage campaign against Cisco Adaptive Security Appliance and related Cisco Secure Firewall platforms, particularly devices exposing WebVPN or Clientless SSLVPN functionality. It is associated with the threat actor UAT4356, also tracked as Storm-1849, and has been observed alongside the companion implant Line Dancer.
Line Runner abuses Cisco ASA WebVPN customization and plug-in functionality tied to CVE-2024-20359 to establish persistence on compromised devices. It leverages the platform’s client bundle auto-install behavior during reboot to install malicious Lua components and maintain a persistent backdoor across restarts. Reporting also indicates attackers in at least one case used CVE-2024-20353 to force a reboot that facilitated installation. Once active, Line Runner enables attackers to upload and execute arbitrary Lua code through crafted HTTP GET requests sent to legitimate WebVPN or AnyConnect URIs, effectively providing remote command execution through a web shell interface.
The malware incorporates multiple defense-evasion and anti-forensic measures. It hides malicious artifacts from normal administrative views, suppresses evidence of suspicious plug-ins, manipulates system scripts to restore persistence after reboot, and can remove or restore artifacts during import or export of WebVPN customizations. It has been described as capable of hindering forensic recovery and reducing visibility into compromise. Operationally, Line Runner has been used together with Line Dancer to support reconnaissance, configuration modification, network traffic capture, staged data retrieval, and exfiltration over HTTP. Campaign reporting also links the broader intrusion set to possible lateral movement and AAA-related access manipulation on targeted devices.
Victimology associated with ArcaneDoor indicates a focused espionage operation affecting a small number of organizations, with government and critical national infrastructure networks prominently represented. The malware reflects a high level of device-specific tradecraft aimed at long-term access to perimeter security appliances and the network visibility they provide.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Cisco uviedla, že CVE-2024-20359 je jednou z dvoch zero-day zraniteľností aktívne zneužívaných v kampani ArcaneDoor proti firewallom Cisco ASA a FTD. Zraniteľnosť funkcie prednahrania klientov VPN a modulov umožňuje autentifikovanému lokálnemu útočníkovi vykonať ľubovoľný kód s oprávneniami root. | Skupine UAT4356 sa podarilo nasadiť dva backdoory, „Line Runner“ a „Line Dancer“, ktoré použila na infiltráciu do zariadení a sieťovej prevádzky a vykonanie škodlivého kódu.
Cisco upozornila na kampaň ArcaneDoor, v ktorej útočníci zneužívajú zero-day zraniteľnosť CVE-2024-20353 na firewalloch Cisco ASA a FTD. Zero-day zraniteľnosť v správe webových serverov a VPN umožňuje neautentifikovanému vzdialenému útočníkovi spôsobiť opätovné načítanie zariadenia, čo môže viesť k odmietnutiu služby (DoS). | Skupine UAT4356 sa podarilo nasadiť dva backdoory, „Line Runner“ a „Line Dancer“, ktoré použila na infiltráciu do zariadení a sieťovej prevádzky a vykonanie škodlivého kódu.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Skupine UAT4356 sa podarilo nasadiť dva backdoory, „Line Runner“ a „Line Dancer“, ktoré použila na infiltráciu do zariadení a sieťovej prevádzky a vykonanie škodlivého kódu.
Cisco Talos previously attributed this group to the ArcaneDoor campaign in 2024, where they exploited two Cisco ASA zero-day vulnerabilities (CVE-2024–20353, CVE-2024–20359) to deploy malware such as Line Dancer and Line Runner.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
...umožňujú autentifikovanému lokálnemu útočníkovi vykonať ľubovoľný kód (CVE-2024-20359), resp. ľubovoľné príkazy (CVE-2024-20358) s oprávneniami používateľa root.
MITRE TTPs ... Line Runner persistence mechanism (T1037)
‘Line Runner’ and ‘Line Dancer’... were used collectively to conduct malicious actions on-target, which included configuration modification...
These affected products have been compromised by malicious actors who successfully established unauthorized access through WebVPN sessions, commonly associated with Clientless SSLVPN services.
UAT4356 deployed two backdoors as components of this campaign, ‘Line Runner’ and ‘Line Dancer,’ which were used collectively to conduct malicious actions on-target.
“Line Runner implements a Lua webshell that is tasked via HTTP(S) GET requests… reachable by sending GET requests to multiple unauthenticated WebVPN endpoints.”
“Line Runner prepends code to several system files… /etc/init.d/umountfs… /asa/scripts/lina_exe_cs.sh…”
“To write to this location it uses a directory traversal technique… ifs.dump(cbizipcontent, “disk0:/csco_config/../../../../../run/lock/subsys/krbkdc6”)”
“The code for this line is obfuscated with base64 encoding.”
“The file is deleted after it has been run.” / “delete the webshell… restore the original index.ini… delete… /asa/scripts/lina_cs (itself)…”
The content repeatedly describes adversaries and malware deleting files, directories, droppers, scripts, logs, archives, staged data, and other artifacts from compromised systems, e.g., 'APT29 has used SDelete to remove artifacts from victim networks' and 'Lazarus Group malware has deleted files in various ways, including "suicide scripts" to delete malware binaries from the victim.'
...„Line Runner“ a „Line Dancer“, ktoré použila na infiltráciu do zariadení a sieťovej prevádzky...
These samples are commands that directed the devices to perform specific actions which resulted in the exfiltration of device configurations, configuration of network captures, and data exfiltration.
Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers. Dyre has the ability to send information staged on a compromised host externally to C2. Line Runner utilizes HTTP to retrieve and exfiltrate information staged using Line Dancer.
ADVSTORESHELL exfiltrates data over the same channel used for C2... Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers... numerous malware and groups sent victim data, files, credentials, or host information over existing C2 channels.
61 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware previously deployed in the ArcaneDoor campaign against Cisco ASA devices.
Line Runner is a backdoor malware used by threat actors to maintain persistence on compromised Cisco ASA and FTD devices. It allows remote access and control, surviving reboots and software upgrades by modifying device ROMMON.
Backdoor deployed in the ArcaneDoor campaign to infiltrate Cisco ASA/FTD devices, access network traffic, and execute malicious code.
Persistent HTTP-based Lua backdoor for Cisco ASA devices that survives reboots and upgrades. It is installed via a malicious client bundle ZIP mechanism and used to maintain persistence and retrieve staged information.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.