Loading story…
Cisco disclosed ArcaneDoor, a large-scale campaign targeting Cisco ASA and Cisco Firepower Threat Defense (FTD) devices through two actively exploited zero-day vulnerabilities, CVE-2024-20353 and CVE-2024-20359. The company said the activity was linked to threat actor UAT4356, also tracked as Storm-1849, which used the Line Runner and Line Dancer backdoors to gain persistent access to perimeter firewalls.
The intrusions allowed attackers to monitor network traffic, execute malicious code, and collect sensitive information from compromised devices. Cisco also patched CVE-2024-20358, a related flaw that can enable root-level command injection, and warned that the affected vulnerabilities could lead to denial of service, arbitrary code execution, and information disclosure. Customers were urged to apply updates immediately and validate device integrity as part of incident response.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Alongside its disclosure, Cisco patched CVE-2024-20358, a command-injection-as-root flaw affecting the same firewall platforms. Cisco urged customers to update immediately and verify device integrity because the flaws could enable denial of service, arbitrary code execution, and information leakage.
Cisco disclosed a large-scale campaign dubbed ArcaneDoor in which attackers exploited two zero-day vulnerabilities, CVE-2024-20353 and CVE-2024-20359, against Cisco ASA and Cisco FTD devices. The activity was attributed to UAT4356, also known as Storm-1849, and involved the Line Runner and Line Dancer backdoors.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco confirmed that attackers have been actively exploiting two zero-day vulnerabilities, CVE-2025-20333 and CVE-2025-20362, in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. These vulnerabilities allow attackers to execute arbitrary code as root and access restricted URLs without authentication, leading to device reloads and denial-of-service (DoS) conditions. The U.K. National Cyber Security Centre (NCSC) and Cisco have linked these exploits to malware campaigns involving RayInitiator and LINE VIPER, and have urged immediate patching. Security advisories highlight that unpatched devices are at risk of persistent compromise, and recommend comprehensive remediation steps including patching, forensic analysis, and resetting credentials. Threat intelligence reports attribute the exploitation campaign to the China-linked group Storm-1849 (ArcaneDoor), which targeted U.S. financial institutions, defense contractors, and military organizations throughout October. Despite public disclosure and patch directives from CISA, attacks continued, demonstrating the attackers' operational sophistication and persistence. Experts warn that organizations running unpatched ASA devices should assume compromise and prioritize forensic hunting for ROM-level malware, as well as implement robust monitoring and maintenance practices to mitigate ongoing risks.
Jun 29, 2026
Cisco is facing U.S. government scrutiny after critical zero-day flaws in **ASA** and **Firepower Threat Defense** devices were tied to the **ArcaneDoor** espionage campaign and deemed an unacceptable risk to federal networks. CISA and the U.K. National Cyber Security Centre linked the activity to `CVE-2025-20333` and `CVE-2025-20362`, while earlier federal action had already added related Cisco flaws `CVE-2024-20353` and `CVE-2024-20359` to the Known Exploited Vulnerabilities catalog after active exploitation. Cisco said the campaign targeted a small set of customers, using the **Line Runner** and **Line Dancer** backdoors for reconnaissance, configuration changes, traffic capture, exfiltration, and possible lateral movement; external reporting and infrastructure analysis pointed to a likely China-aligned espionage actor, and internet scans suggested tens of thousands of Cisco firewall devices were exposed. The incident has drawn political attention in Washington, with Sen. Bill Cassidy seeking answers from Cisco on customer impact, breach notifications, and communications with federal agencies after reports that at least one federal agency may have been compromised. The response echoes earlier federal emergency actions over perimeter-device exploitation, including the 2021 campaign in which suspected Chinese hackers used **Pulse Secure** VPN vulnerabilities to breach multiple U.S. agencies, critical infrastructure entities, and private-sector organizations, deploying webshells and bypassing passwords and multifactor authentication. Together, the cases underscore continuing risk from internet-facing security appliances that can provide long-term access for state-backed espionage when zero-days remain unpatched.
Jun 29, 2026
Cisco confirmed that multiple government agencies engaged its incident response teams in May 2025 to investigate targeted attacks against Cisco Adaptive Security Appliance (ASA) 5500-X Series devices running Cisco Secure Firewall ASA Software with VPN web services enabled. Attackers exploited multiple zero-day vulnerabilities to implant malware, execute commands, and potentially exfiltrate data from compromised devices. The threat actor demonstrated advanced evasion techniques, including disabling logging, intercepting CLI commands, and intentionally crashing devices to hinder forensic analysis. Cisco’s investigation, which involved providing instrumented images and analyzing packet captures and firmware, led to the identification of a critical memory corruption bug in the ASA software. The company assessed with high confidence that the activity was linked to the same threat actor behind the ArcaneDoor campaign previously reported in 2024. While the vulnerable software is present on other hardware platforms and in Cisco Secure Firewall Threat Defense (FTD) Software, there is no evidence of successful compromise beyond the ASA 5500-X Series. Cisco published detailed detection guidance, highlighting that the threat actor continues to scan for vulnerable devices using frequently changing IP addresses, and that scanning activity alone does not indicate compromise. Only specific ASA 5500-X models running certain software releases with VPN web services enabled have been confirmed as compromised. The threat actor suppressed specific syslog messages in memory as a forensic countermeasure, and a downward shift in these logs may indicate malicious activity. On September 25, 2025, Cisco released security advisories addressing critical vulnerabilities, including CVE-2025-20333, CVE-2025-20362, and CVE-2025-20363, affecting a range of ASA and FTD software versions. The Canadian Centre for Cyber Security issued alerts urging organizations to review Cisco’s advisories, apply mitigations, and update affected devices. The vulnerabilities allow for remote code execution and unauthorized access via VPN web services and HTTP servers on affected firewall products. Cisco’s advisories provided a comprehensive list of affected software versions and recommended immediate action to mitigate risk. The incident underscores the sophistication of the threat actor, the importance of timely patching, and the need for enhanced monitoring of VPN-enabled firewall devices. Cisco’s response included collaboration with affected customers, deployment of enhanced detection capabilities, and ongoing monitoring for further malicious activity. Organizations are advised to follow Cisco’s guidance, monitor for suppressed syslog IDs, and engage Cisco Technical Assistance Center if compromise is suspected. The campaign highlights the persistent targeting of network edge devices by advanced threat actors and the criticality of maintaining up-to-date security controls.
Jun 29, 2026