Cisco Zero-Days Anchor 'ArcaneDoor' Cyber-Espionage Campaign

Cisco Talos discovered a state-sponsored campaign dubbed "ArcaneDoor" (UAT4356 / STORM-1849) that used two Cisco ASA zero-day vulnerabilities to deploy two custom backdoors—Line Dancer (memory-resident shellcode executor) and Line Runner (persistence mechanism)—against government networks globally; the report includes evidence of active exploitation, IoCs, detection commands, and remediation steps including patches and removal guidance.