ArcaneDoor – New espionage-focused campaign found targeting perimeter network devices

MITRE Techniques

• [T1037] Boot or Logon Autostart Execution – Line Runner leverages the ASA boot behavior that unzips and executes a client_bundle*.zip at boot to persist: [‘If the file exists, it will unzip it and execute the script csco_config.lua.’]
• [T1653] Abuse Elevation/Resource Reboot (reboot to trigger payload) – Actor abused a vulnerability to reboot devices to trigger ZIP unpack/install (CVE-2024-20353): [‘attackers were able to leverage this vulnerability to cause the target ASA device to reboot, triggering the unzipping and installing the second component’]
• [T1140] Deobfuscation/Decoding – The host-scan-reply hook decodes base64 payloads before executing them: [‘it base64-decodes the payload, copies it into the attacker’s writable and executable memory region, and then calls the newly decoded function.’]
• [T0874] Hooking/Function Hooking – The attacker replaces the processHostScanReply() pointer to run their decoder/runner: [‘the entry that should point to processHostScanReply() now instead points to the attacker’s function that decodes and runs its payload.’]
• [T1562/001] Impair Defenses: Disable or Modify System Logging – The implant disables syslog and tampers with AAA to hide activity: [‘Disable syslog.’]
• [T1055] Process Injection – Line Dancer injects and executes shellcode in memory to run commands and hook system functions: [‘memory-resident shellcode interpreter that enables adversaries to upload and execute arbitrary shellcode payloads.’]
• [T1059] Command and Scripting Interpreter – The actor executes CLI commands and configuration mode commands via shellcode (including write mem): [‘Execute CLI commands present in shellcode; this includes configuration mode commands and the ability to save them to memory (write mem).’]
• [T1556] Modify Authentication Process – Hooking AAA and implementing a “magic number” or exporting P12 blobs to bypass AAA and create VPN tunnels: [‘Hook the AAA function to allow for a magic number authentication capability… a P12 blob is generated along with an associated certificate and exfiltrated.’]
• [T1070/004] Indicator Removal on Host: File Deletion – The persistence scripts remove traces and the ZIP file after processing to evade detection: [‘Once processed, the ZIP file is deleted.’]
• [T1557] Man-in-the-Middle / HTTP Interception – Line Runner intercepts HTTP requests and executes payloads from 32-character parameters as its C2 mechanism: [‘Intercepts HTTP requests to the ASA… payload contained within one of these parameters is written to a Lua script and executed.’]
• [T1071/001] Application Layer Protocol: Web Protocols (HTTP) – Command-and-control and backdoor communication occur over HTTP(S) parameters: [‘This is the backdoor’s command and control mechanism.’]
• [T1102/003] One-way Communication (HTTP long-poll/backdoor) – The backdoor implements a one-way HTTP-based Lua backdoor that listens for victim-specific parameters to execute payloads: [‘looks for an HTTP request with a set of 32-character parameters that are victim-dependent.’]
• [T1041] Exfiltration Over C2 Channel – Actors staged and retrieved configuration and packet captures for exfiltration via the implants’ C2: [‘Run and exfiltrate the command show configuration… Create and exfiltrate packet captures.’]
• [T1040] Network Sniffing – The implants create packet captures on the ASA for traffic monitoring/exfiltration: [‘Create and exfiltrate packet captures.’]