Defending Against ArcaneDoor: How Eclypsium Protects Network Devices

Introduction

In coordination with multiple government agencies, Cisco announced yesterday the discovery of a new backdoor targeting their Adaptive Security Appliances (ASA). The threat actor is new, tracked by Cisco as UAT4356 and STORM-1849 by Microsoft, and leveraged two zero-day vulnerabilities in the campaign dubbed ArcaneDoor. The campaign started in November 2023, predating the recent attacks against Ivanti Connect Secure and Palo Alto Networks PAN-OS but unlike those campaigns, the zero days involved were not used for initial access (according …

actor adaptive security arcanedoor asa backdoor campaign cisco coordination defending devices discovery eclypsium government government agencies introduction microsoft network network devices november november 2023 security storm targeting threat threat actor uat4356 vulnerabilities zero-day zero-day vulnerabilities