ArcaneDoor
ArcaneDoor is a state-sponsored espionage threat actor/campaign tracked by Cisco Talos as UAT4356 and by Microsoft as Storm-1849. The content repeatedly links it to China or describes it as China-affiliated/China-linked, and Cisco and government partners linked later 2025 exploitation activity to the same actor behind the earlier ArcaneDoor attacks. ArcaneDoor has targeted government-owned perimeter network devices globally, including Cisco ASA and Firepower Threat Defense appliances, and earlier reporting also notes compromises of government and telecom networks. Reported tradecraft includes abusing WebVPN traffic and WebVPN sessions associated with clientless SSL VPN services to achieve unauthorized remote code execution; exploiting Cisco vulnerabilities including CVE-2024-20353 and CVE-2024-20359 in the 2024 campaign and CVE-2025-20333 and CVE-2025-20362 in later related activity; deploying bespoke tooling and backdoors including Line Runner, Line Dancer, FIRESTARTER, and the LINE VIPER post-exploitation toolkit; executing CLI commands; collecting packet captures, system configuration information, and victim device configuration information; exfiltrating data over existing command-and-control channels; modifying Cisco ASA AAA functionality to bypass normal authentication, authorization, and accounting operations; intercepting harvested user CLI commands; suppressing syslog/logging; and establishing persistence, including a previously unknown mechanism preserved across upgrades and ROMmon/boot-process persistence described for FIRESTARTER. The actor is also described as using dedicated adversary-controlled VPS infrastructure for command and control.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
36 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
5 malware families attributed to this actor across reporting.
Associated vulnerabilities
5 CVEs this actor has used in observed campaigns. 5 of them exploited in the wild.
Two of these, CVE-2025-20333 and CVE-2025-20362, are currently under active exploitation by adversaries in the wild... A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication.
Two of these, CVE-2025-20333 and CVE-2025-20362, are currently under active exploitation by adversaries in the wild... A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device.
CISA added two Cisco product vulnerabilities — CVE-2024-20353 and CVE-2024-20359 — to the Known Exploited Vulnerabilities catalog. Cisco warned they are being exploited as part of a campaign by state-sponsored threat actors affecting Cisco ASA and Firepower Threat Defense devices.
CISA added two Cisco product vulnerabilities — CVE-2024-20353 and CVE-2024-20359 — to the Known Exploited Vulnerabilities catalog. Cisco warned they are being exploited as part of a campaign by state-sponsored threat actors affecting Cisco ASA and Firepower Threat Defense devices.
The hackers are, reportedly, chaining together two known vulnerabilities in the Cisco ASA devices, identified as CVE-2025-30333 (CVSS 9.9) and CVE-2025-20362 (CVSS 6.5). This combined attack allows them to gain deep, persistent control over the appliances. CVE-2025-30333 is a serious issue that lets an attacker with VPN credentials run their own code on the device...
Observables
62 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A China-affiliated campaign linked to attacks against Cisco firewall and switch infrastructure using remote code execution and privilege escalation to gain persistent unauthorized access.
Associated with exploitation of Cisco ASA/FTD vulnerabilities to deploy the FIRESTARTER backdoor and LINE VIPER post-exploitation toolkit for persistent access to compromised network appliances.
Referenced as an example of a named activity cluster associated with exploiting edge devices to maintain persistent access into targeted networks.
State-sponsored cyber-espionage activity leveraging Cisco zero-day vulnerabilities.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.