ArcaneDoor Campaign Targeting Cisco Adaptive Security Appliance 0day (Campaign)

Cisco disclosed two zero‑day vulnerabilities in ASA/FTD appliances exploited since November 2023 by a state‑linked group (UAT4356/STORM-1849) in the ArcaneDoor espionage campaign. Exploitation allowed denial‑of‑service and persistent local code execution enabling deployment of Line Dancer (in‑memory shellcode loader) and Line Runner (persistent Lua backdoor) to capture and exfiltrate network traffic and maintain covert access; Cisco released security updates and urged immediate patching.