CVE-2024-20353, CVE-2024-20359: Frequently Asked Questions About ArcaneDoor
Frequently asked questions about CVE-2024-20353 and CVE-2024-20359, two vulnerabilities associated with “ArcaneDoor,” the espionage-related campaign targeting Cisco Adaptive Security Appliances.
Background
The Tenable Security Response Team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding an espionage campaign called ArcaneDoor.
FAQ
What is ArcaneDoor?
ArcaneDoor is the name given to an espionage-focused campaign disclosed by researchers at Cisco Talos on April 24. The campaign involves a reported state-sponsored actor who has been targeting vulnerable network devices including Cisco’s Adaptive Security Appliances (ASA). The campaign included the exploitation of at least two zero-day vulnerabilities.
What are the vulnerabilities associated with ArcaneDoor?
As of April 25, the following vulnerabilities are attributed to the ArcaneDoor campaign:
| CVE | Description | CVSSv3 |
|---|---|---|
| CVE-2024-20353 | Cisco ASA and Firepower Threat Defense (FTD) Software Web Services Denial of Service Vulnerability | 8.6 |
| CVE-2024-20359 | Cisco ASA and FTD Software Persistent Local Code Execution Vulnerability | 6.0 |
Who is the group behind ArcaneDoor?
The group has been labeled UAT4356 by Cisco and STORM-1849 by Microsoft. Cisco attributes this activity with “high confidence” to a state-sponsored actor, though it is unconfirmed which state the group is associated with.
What is the initial access vector for ArcaneDoor?
As of April 25, the initial access vector for the ArcaneDoor campaign is unknown. The investigation into ArcaneDoor is ongoing. We will update this blog post once additional information becomes available.
When did the ArcaneDoor campaign begin?
Cisco says UAT4356 began the development and testing phase for this campaign back in July 2023, setting up the infrastructure for the campaign in November 2023. However, malicious activity associated with ArcaneDoor occurred between December 2023 and early January 2024.
Is any malware associated with ArcaneDoor?
Yes, it appears that UAT4356 deployed two types of malware in the ArcaneDoor campaign:
- Line Dancer: in-memory malware for executing commands and evading analysis
- Line Runner: backdoor malware to maintain persistence
For analysis of Line Dancer and Line Runner, please refer to the Cisco Talos blog post.
Are there any other good sources of information about ArcaneDoor?
Yes, the Canadian Centre for Cyber Security (Cyber Centre) published an article providing additional insights into the malicious activity associated with ArcaneDoor. In it, the Cyber Centre says that Cisco ASA series ASA55xx running firmware versions 9.12 and 9.14 have been targeted by malicious actors that “established unauthorized access through WebVPN sessions,” which are “commonly associated with Clientless SSLVPN services.”
Are patches available for the vulnerabilities associated with ArcaneDoor?
Yes, Cisco released patches for affected versions of ASA and FTD. For more information, refer to the individual advisory pages for CVE-2024-20353 and CVE-2024-20359.
Cisco published an advisory CVE-2024-20358. Is this CVE associated with ArcaneDoor?
No. While this vulnerability affects the same products and was published alongside the advisories for CVE-2024-20353 and CVE-2024-20359, it was reportedly discovered by Cisco during internal security testing and is not associated with ArcaneDoor.
Are there indicators of compromise (IOCs) associated with ArcaneDoor?
Yes, Cisco published IOCs for ArcaneDoor in its blog post and on GitHub.
Has Tenable released any product coverage for these vulnerabilities?
A list of Tenable plugins for these vulnerabilities can be found on the individual CVE pages as they’re released:
This link will display all available plugins for these vulnerabilities, including upcoming plugins in our Plugins Pipeline.
Get more information
- ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices
- Canadian Centre for Cyber Security: Cyber Activity Impacting CISCO ASA VPNs
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.
Related Articles
Cybersecurity Snapshot: Attackers Pounce on Unpatched Vulns, DBIR Says, as Critical Infrastructure Orgs Benefit from CISA’s Alert Program
May 3, 2024Verizon’s DBIR found that hackers are having a field day exploiting vulnerabilities to gain initial access. Plus, a CISA program is helping critical infrastructure organizations prevent ransomware attacks. In addition, check out what Tenable’s got planned for RSA Conference 2024. And get the latest on the Change Healthcare breach. And much more!
Tenable Bolsters Its Cloud Security Arsenal with Malware Detection
May 1, 2024Tenable Cloud Security is enhancing its capabilities with malware detection. Combined with its cutting-edge, agentless vulnerability-scanning technology, including its ability to detect anomalous behavior, this new capability makes Tenable Cloud Security a much more complete and effective solution. Read on to find out how.
Cybersecurity Snapshot: Latest MITRE ATT&CK Update Offers Security Insights on GenAI, Identity, Cloud and CI/CD
April 26, 2024Check out what’s new in Version 15 of the MITRE ATT&CK knowledge base of adversary tactics, techniques and procedures. Plus, learn the latest details about the Change Healthcare breach, including the massive scope of the data exfiltration. In addition, why AI cyberthreats aren’t impacting CISOs’ budgets. And much more!
Cybersecurity Snapshot: Attackers Pounce on Unpatched Vulns, DBIR Says, as Critical Infrastructure Orgs Benefit from CISA’s Alert Program
May 3, 2024Verizon’s DBIR found that hackers are having a field day exploiting vulnerabilities to gain initial access. Plus, a CISA program is helping critical infrastructure organizations prevent ransomware attacks. In addition, check out what Tenable’s got planned for RSA Conference 2024. And get the latest on the Change Healthcare breach. And much more!
As Pro-Russia Hactivists Target OT Systems, Here’s What You Need To Know
May 2, 2024U.S. and international cybersecurity and law enforcement agencies this week issued a joint fact sheet to highlight and safeguard against the continued malicious cyber activity conducted by pro-Russia hacktivists against operational technology (OT) devices in North America and Europe. Read on to get all the details and learn what actions to take today.
Tenable Bolsters Its Cloud Security Arsenal with Malware Detection
May 1, 2024Tenable Cloud Security is enhancing its capabilities with malware detection. Combined with its cutting-edge, agentless vulnerability-scanning technology, including its ability to detect anomalous behavior, this new capability makes Tenable Cloud Security a much more complete and effective solution. Read on to find out how.
- Exposure Management
- Vulnerability Management
- Exposure Management
- Vulnerability Management