MalwareUsed by 2 actorsExploits 5 CVEs

Line Dancer

Line Dancer is a memory-resident, 64-bit shellcode loader targeting Cisco Adaptive Security Appliance (ASA) devices. It was observed in attacks during late 2023 and early 2024 associated with the ArcaneDoor espionage campaign, attributed to the state-sponsored threat actor UAT4356, also tracked as Storm-1849. The campaign targeted perimeter network infrastructure, including VPN appliances serving government and critical national infrastructure networks worldwide.

The implant operates within the ASA's LINA process and redirects a function pointer used to parse the WebVPN host-scan-reply XML field. It accepts tasking through HTTP(S) POST requests during SSL VPN session establishment. Requests must contain a victim-specific, hardcoded 32-byte authentication token; matching requests cause the remaining data to be Base64-decoded and executed as shellcode. After execution, control returns to the legitimate parser. The loader resides in a non-file-backed memory region with read, write, and execute permissions and overwrites previously loaded payloads when processing new tasking.

Line Dancer enables arbitrary command execution and additional payload deployment. Its operational capabilities include collecting device configurations, creating and exfiltrating network packet captures, and exfiltrating collected data through command-and-control channels. Associated payloads can disable system logging, interfere with crash-dump collection, and bypass authentication, authorization, and accounting mechanisms to conceal activity and facilitate unauthorized access.

Line Dancer is nonpersistent and distinct from Line Runner, the persistent Lua webshell deployed alongside it. Rebooting removes Line Dancer and its volatile forensic traces; persistence in the paired deployment is provided by Line Runner.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

5 CVES

CVE-2024-20359Persistent local root code execution in Cisco ASA and FTDExploited in the wild

CVE-2024-20359 (CVSS: 6.0/10.0 - Medium) is a persistent local code-execution vulnerability. An authenticated local attacker with Administrator-level privileges can copy a crafted file to disk0: and execute arbitrary code with root privileges after the next device reload. | Line Dancer is an in-memory implant that enables the uploading and execution of arbitrary shellcode payloads. It exploits a legacy VPN client pre-loading mechanism on Cisco ASA devices.

via imda singaporeimda.gov.sg

CVE-2024-20353Web Services Denial of Service in Cisco ASA and FTDExploited in the wild

CVE-2024-20353 (CVSS: 8.6/10.0 - High) is a denial-of-service vulnerability caused by incomplete error checking when parsing an HTTP header. A crafted HTTP request can cause an affected device to reload unexpectedly. | Line Dancer is an in-memory implant that enables the uploading and execution of arbitrary shellcode payloads. It exploits a legacy VPN client pre-loading mechanism on Cisco ASA devices.

via imda singaporeimda.gov.sg

CVE-2025-20333Authenticated root RCE in Cisco ASA and FTD VPN web serverExploited in the wild

On September 25th, 2025, Cisco disclosed two zero-day vulnerabilities, CVE-2025-20333 (CVSS: 9.9) and CVE-2025-20362 (CVSS: 6.5), in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. The disclosure confirmed that the vulnerabilities are being actively exploited in the wild; CVE-2025-20333 allows authenticated, remote attackers to execute arbitrary code on vulnerable ASA and FTD instances.

via esentire product advisoriesesentire.com

CVE-2024-20358Backup Restore Command Injection in Cisco ASA and FTDExploited in the wild

Patches to the three vulnerabilities - CVE-2024-20353 (CVSS 8.6), CVE-2024-20359 (CVSS 6.0) and CVE-2024-20358 (CVSS 6.0) - are included in the advisory... The blogpost from Talos outlines how two of the vulnerabilities were exploited to escalate privileges and to establish persistence.

via mnemonic blogmnemonic.io

CVE-2025-20362Authentication bypass in Cisco ASA and FTD VPN web serverExploited in the wild

The disclosure confirmed that the vulnerabilities are being actively exploited in the wild; CVE-2025-20362 enables remote attackers to access restricted URL endpoints without authentication.

via esentire product advisoriesesentire.com

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

ArcaneDoor

Cisco assessed with high confidence that the same operators were responsible for the April 2024 ArcaneDoor campaign, which deployed custom malware frameworks (e.g., Line Dancer and Line Runner) on ASA devices.

via hunter strategy blogblog.hunterstrategy.net

UAT-4356

Cisco Talos previously attributed this group to the ArcaneDoor campaign in 2024, where they exploited two Cisco ASA zero-day vulnerabilities (CVE-2024–20353, CVE-2024–20359) to deploy malware such as Line Dancer and Line Runner.

via osint team blogosintteam.blog

MITRE ATT&CK

Techniques & procedures

28 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence2

The attackers successfully exploited these vulnerable devices to deploy malware, execute remote commands, and potentially exfiltrate data.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence2

Line Runner is a persistent webshell enabling threat actors to upload and execute arbitrary Lua scripts.

T1059.008Network Device CLIEvidence2

T1203Exploitation for Client ExecutionEvidence1

In ArcaneDoor incidents, threat actors exploited CVE-2024-20353 and CVE-2024-20359 to deliver a previously unidentified webshell dubbed LINE RUNNER and an in-memory implant dubbed LINE DANCER.

Persistence

3 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

It modifies the /etc/init.d/unmountfs script to copy the malware ZIP file from a hidden location to disk0 during boot.

T1556Modify Authentication ProcessEvidence2

Bypassing of the AAA mechanism.

T1653Power SettingsEvidence3

The reboot action via CVE-2024-20353.

Privilege Escalation

3 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

It modifies the /etc/init.d/unmountfs script to copy the malware ZIP file from a hidden location to disk0 during boot.

T1055Process InjectionEvidence1

Injection of code into AAA and Crash Dump processes.

T1068Exploitation for Privilege EscalationEvidence1

The blogpost from Talos outlines how two of the vulnerabilities were exploited to escalate privileges and to establish persistence.

Stealth

6 techniques

T1014RootkitEvidence2

T1055Process InjectionEvidence1

Injection of code into AAA and Crash Dump processes.

T1070Indicator RemovalEvidence1

...control the enabling and disabling of the devices’ syslog service to obfuscate additional commands...

T1070.004File DeletionEvidence1

After installation, it deletes itself from disk to avoid detection.

T1140Deobfuscate/Decode Files or InformationEvidence2

T1620Reflective Code LoadingEvidence1

LINE DANCER is a shellcode loader used to deploy additional payloads.

Defense Impairment

3 techniques

T1556Modify Authentication ProcessEvidence2

Bypassing of the AAA mechanism.

T1685Disable or Modify ToolsEvidence1

Line Runner ... allow[s] attackers to disable syslog... 'Line Dancer' also manipulates crash dumps and authentication systems to hinder forensic analysis.

T1690Prevent Command History LoggingEvidence2

Credential Access

3 techniques

T1040Network SniffingEvidence5

The two threats have been used by threat actors to modify configurations, conduct reconnaissance, capture and exfiltrate network traffic, and perform lateral movement to other systems.

T1556Modify Authentication ProcessEvidence2

Bypassing of the AAA mechanism.

T1557Adversary-in-the-MiddleEvidence1

HTTP interception for C2 communications.

Discovery

3 techniques

T1016System Network Configuration DiscoveryEvidence1

The two threats have been used by threat actors to modify configurations, conduct reconnaissance, capture and exfiltrate network traffic, and perform lateral movement to other systems.

T1040Network SniffingEvidence5

The two threats have been used by threat actors to modify configurations, conduct reconnaissance, capture and exfiltrate network traffic, and perform lateral movement to other systems.

T1082System Information DiscoveryEvidence4

UAT4356 deployed two backdoors, “Line Runner” and “Line Dancer,” to conduct malicious actions, including configuration modification, reconnaissance, network traffic capture/exfiltration, and potentially lateral movement.

Lateral Movement

1 technique

T1210Exploitation of Remote ServicesEvidence1

Exploitation of the vulnerabilities requires enabled SSL VPN, IPsec IKEv2 VPN with “client services”, or exposure of the HTTPS administration interface.

Collection

3 techniques

T1074Data StagedEvidence1

Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers. Dyre has the ability to send information staged on a compromised host externally to C2. Line Runner utilizes HTTP to retrieve and exfiltrate information staged using Line Dancer.

T1213Data from Information RepositoriesEvidence1

Úspešné zneužitie umožňuje útočníkom šíriť malvér a zbierať citlivé informácie v cieľovom prostredí.

T1557Adversary-in-the-MiddleEvidence1

HTTP interception for C2 communications.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence3

HTTP C2.

T1102.003One-Way CommunicationEvidence1

HTTP C2 one-way backdoor.

T1105Ingress Tool TransferEvidence1

Skupine UAT4356 sa podarilo nasadiť dva backdoory, „Line Runner“ a „Line Dancer“...

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence5

T1567Exfiltration Over Web ServiceEvidence1

Access, gained via exploitation of these vulnerabilities and malware deployment, allowed threat actors to “generate text versions of the device’s configuration file so that it could be exfiltrated through web requests..."

INDICATORS OF COMPROMISE

IOCs tracked for this family

60 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

60 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

21 SOURCESView more in app

osint team blogNews

May 8, 2026

Uncovering FIRESTARTER: Ongoing Cisco ASA Compromise Despite Patch Deployment | by Criminal IP | May, 2026 | OSINT Team

Malware previously deployed in the ArcaneDoor campaign against Cisco ASA devices.

hunter strategy blogNews

Oct 6, 2025

Cisco 0-Day Exploitation: ArcaneDoor Attribution Confirmed

Custom malware framework deployed on Cisco ASA devices during the April 2024 ArcaneDoor campaign. Mentioned as historical background supporting continuity of actor involvement; the content does not establish its deployment in the current campaign or describe its individual capabilities.

the hacker newsNews

Sep 26, 2025

Cisco ASA Firewall Zero-Day Exploits Deploy RayInitiator and LINE VIPER Malware

Referenced as a prior/less comprehensive related malware/tool compared to LINE VIPER; no additional functional details provided in the content.

bleeping computerNews

Sep 25, 2025

CISA orders agencies to patch Cisco flaws exploited in zero-day attacks

Line Dancer is an in-memory shellcode loader deployed by threat actors to facilitate the execution of malicious payloads on compromised Cisco ASA and FTD devices. It is used to load and execute shellcode directly in memory, aiding in evasion and persistence.

+15 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching60

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities5

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping28

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Line Dancer