C0046 ArcaneDoor

active2023-07-01 – 2024-04-01

also known asArcaneDoor

ArcaneDoor is a campaign targeting networking devices from Cisco and other vendors between July 2023 and April 2024, primarily focused on government and critical infrastructure networks. ArcaneDoor is associated with the deployment of the custom backdoors Line Runner and Line Dancer. ArcaneDoor is attributed to a group referred to as UAT4356 or STORM-1849, and is assessed to be a state-sponsored campaign.

01

techniques used (25)

ATT&CK techniques this enables or maps to.

02

software used (2)

Malware and tools associated with this.

03

source

Where this definition is published.

view on ATT&CK