State-Sponsored Hackers Exploit Two Cisco Zero-Day Vulnerabilities for Espionage

Cisco Talos reported a campaign dubbed 'ArcaneDoor' (attributed to UAT4356/Storm-1849) that used two zero-day vulnerabilities in Cisco ASA/Firepower appliances to install two implants—Line Runner (persistent Lua HTTP implant) and Line Dancer (in-memory backdoor)—enabling configuration changes, packet capture/exfiltration, and stealthy espionage; CISA added the flaws to its KEV and vendors released fixes.