ArcaneDoor Attack (CVE-2024-20353 and CVE-2024-20359)

What is the Attack?
Cisco issued an advisory on 24th April, regarding its Adaptive Security Appliances, multifunctional devices combining firewall, VPN, and other security functions. It reported that these appliances had become the focus of state-sponsored espionage, with attackers exploiting two previously unknown vulnerabilities to infiltrate government entities worldwide. In this campaign, two backdoors were deployed: "Line Runner" and "Line Dancer." These backdoors operated in tandem to execute various malicious activities on the target systems, encompassing configuration alterations, reconnaissance, capturing/exfiltrating …

adaptive security advisory april arcanedoor attack attackers backdoors campaign cisco cve cve-2024 devices entities espionage exploiting firewall focus functions government government entities security sponsored state vpn vulnerabilities what is