Loading malware…
Line Dancer is a memory-resident implant and shellcode loader used in the ArcaneDoor espionage campaign against Cisco Adaptive Security Appliance (ASA) devices, and associated reporting also links the broader activity to Cisco Firepower Threat Defense environments. It has been attributed to the threat actor UAT4356, also tracked as Storm-1849, and has been observed alongside the related Line Runner implant. The malware is designed for post-compromise operations on perimeter network devices, particularly to enable covert execution of attacker-supplied payloads and collection of sensitive network and device data.
Line Dancer operates in memory rather than as a conventional on-disk binary. It hooks WebVPN processing by replacing a function pointer associated with parsing a WebVPN XML field, allowing the actor to submit tasking through crafted HTTPS requests. The implant validates a victim-specific token, base64-decodes the supplied data, treats the decoded content as shellcode, and executes it in memory before returning control to legitimate processing. Reporting also describes it as part of a larger framework and, in some cases, as a Lua-based shellcode loader component used to process malicious payloads that execute system commands.
Observed capabilities include execution of arbitrary shellcode and commands, reconnaissance, configuration collection, packet capture, and exfiltration of collected data over command-and-control channels. On compromised devices it has been used to obtain configuration data, capture and exfiltrate network traffic, and support broader malicious actions that may include lateral movement. Additional reported behaviors include disabling or suppressing logging, interfering with crash-dump handling to reduce forensic visibility, and hooking authentication, authorization, and accounting logic to bypass normal access controls for actor-controlled access.
Line Dancer has been associated with exploitation of Cisco ASA zero-day vulnerabilities CVE-2024-20353 and CVE-2024-20359 during ArcaneDoor. In at least some intrusions, attackers used these capabilities in combination with the persistent Line Runner backdoor, with Line Runner providing durable access and Line Dancer providing in-memory payload execution and operational flexibility. Targeting has centered on government and critical infrastructure networks through exposed VPN and edge-device services, consistent with a state-sponsored espionage objective.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Cisco upozornila na kampaň ArcaneDoor, v ktorej útočníci zneužívajú zero-day zraniteľnosť CVE-2024-20353 na firewalloch Cisco ASA a FTD. Zero-day zraniteľnosť v správe webových serverov a VPN umožňuje neautentifikovanému vzdialenému útočníkovi spôsobiť opätovné načítanie zariadenia, čo môže viesť k odmietnutiu služby (DoS). | Skupine UAT4356 sa podarilo nasadiť dva backdoory, „Line Runner“ a „Line Dancer“, ktoré použila na infiltráciu do zariadení a sieťovej prevádzky a vykonanie škodlivého kódu.
Cisco uviedla, že CVE-2024-20359 je jednou z dvoch zero-day zraniteľností aktívne zneužívaných v kampani ArcaneDoor proti firewallom Cisco ASA a FTD. Zraniteľnosť funkcie prednahrania klientov VPN a modulov umožňuje autentifikovanému lokálnemu útočníkovi vykonať ľubovoľný kód s oprávneniami root. | Skupine UAT4356 sa podarilo nasadiť dva backdoory, „Line Runner“ a „Line Dancer“, ktoré použila na infiltráciu do zariadení a sieťovej prevádzky a vykonanie škodlivého kódu.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Skupine UAT4356 sa podarilo nasadiť dva backdoory, „Line Runner“ a „Line Dancer“, ktoré použila na infiltráciu do zariadení a sieťovej prevádzky a vykonanie škodlivého kódu.
Cisco Talos previously attributed this group to the ArcaneDoor campaign in 2024, where they exploited two Cisco ASA zero-day vulnerabilities (CVE-2024–20353, CVE-2024–20359) to deploy malware such as Line Dancer and Line Runner.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
...umožňujú autentifikovanému lokálnemu útočníkovi vykonať ľubovoľný kód (CVE-2024-20359), resp. ľubovoľné príkazy (CVE-2024-20358) s oprávneniami používateľa root.
LINE DANCER is a persistent Lua-based shellcode loader, which is a component of a larger framework. This shellcode loader would process malicious payloads that execute system commands.
‘Line Runner’ and ‘Line Dancer’... were used collectively to conduct malicious actions on-target, which included configuration modification...
These affected products have been compromised by malicious actors who successfully established unauthorized access through WebVPN sessions, commonly associated with Clientless SSLVPN services.
UAT4356 deployed two backdoors as components of this campaign, ‘Line Runner’ and ‘Line Dancer,’ which were used collectively to conduct malicious actions on-target.
“Line Dancer is not persistent, the actor achieves persistence on ASA devices via Line Runner… a persistent Lua webshell…”
“This data is then base64-decoded and copied into a fixed memory address… The base64-decoded data is expected to be shellcode.”
MITRE TTPs ... Injection of code into AAA and Crash Dump processes (T1055)
The malicious actors were able to control the enabling and disabling of the devices syslog service to obfuscate additional commands.
The content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'
“An observed Line Dancer payload changes the memory protections of a region of lina, this results in the text section being split and causing multiple executable memory regions for lina… suspicious, especially if one is of size 0x1000.”
...„Line Runner“ a „Line Dancer“, ktoré použila na infiltráciu do zariadení a sieťovej prevádzky...
The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."
These samples are commands that directed the devices to perform specific actions which resulted in the exfiltration of device configurations, configuration of network captures, and data exfiltration.
Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers. Dyre has the ability to send information staged on a compromised host externally to C2. Line Runner utilizes HTTP to retrieve and exfiltrate information staged using Line Dancer.
ADVSTORESHELL exfiltrates data over the same channel used for C2... Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers... numerous malware and groups sent victim data, files, credentials, or host information over existing C2 channels.
60 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware previously deployed in the ArcaneDoor campaign against Cisco ASA devices.
Referenced as a prior/less comprehensive related malware/tool compared to LINE VIPER; no additional functional details provided in the content.
Line Dancer is an in-memory shellcode loader deployed by threat actors to facilitate the execution of malicious payloads on compromised Cisco ASA and FTD devices. It is used to load and execute shellcode directly in memory, aiding in evasion and persistence.
Backdoor deployed in the ArcaneDoor campaign to infiltrate Cisco ASA/FTD devices, access network traffic, and execute malicious code.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.