#arcanedoor — Public Fediverse posts

📢 UAT-4356 déploie le backdoor FIRESTARTER sur les équipements Cisco Firepower via des CVE n-day
📝 ## 🔍 Contexte

Publié le 23 avril 2026 par **Cisco Talos**, cet article constitu...
📖 cyberveille : https://cyberveille.ch/posts/2026-04-26-uat-4356-deploie-le-backdoor-firestarter-sur-les-equipements-cisco-firepower-via-des-cve-n-day/
🌐 source : https://blog.talosintelligence.com/uat-4356-firestarter/?utm_source=substack&utm_medium=email
#ArcaneDoor #CVE_2025_20333 #Cyberveille

Firestarter Malware Evades Cisco Firewall Updates, Persists Across Reboots

A custom backdoor called Firestarter has been discovered evading Cisco firewall updates and persisting across reboots, posing a significant threat to cybersecurity. This sophisticated malware is attributed to a threat actor linked to cyberespionage campaigns, including the notorious ArcaneDoor operation.

https://osintsights.com/firestarter-malware-evades-cisco-firewall-updates-persists-across-reboots?utm_source=mastodon&utm_medium=social

#FirestarterMalware #CiscoFirewall #Uat4356 #Arcanedoor #Cyberespionage

🚨 The Cybersecurity and Infrastructure Security Agency (#CISA) has flagged active attacks exploiting two critical flaws in #Cisco ASA and Firepower devices (CVE-2025-20362 + CVE-2025-20333) used in the #ArcaneDoor campaign.

Read: https://hackread.com/cisa-attacks-cisco-asa-firepower-flaws/

#CyberSecurity #Vulnerability #Infosec #Firepower

🚨 The Cybersecurity and Infrastructure Security Agency (#CISA) has flagged active attacks exploiting two critical flaws in #Cisco ASA and Firepower devices (CVE-2025-20362 + CVE-2025-20333) used in the #ArcaneDoor campaign.

Read: https://hackread.com/cisa-attacks-cisco-asa-firepower-flaws/

#CyberSecurity #Vulnerability #Infosec #Firepower

🚨 The Cybersecurity and Infrastructure Security Agency (#CISA) has flagged active attacks exploiting two critical flaws in #Cisco ASA and Firepower devices (CVE-2025-20362 + CVE-2025-20333) used in the #ArcaneDoor campaign.

Read: https://hackread.com/cisa-attacks-cisco-asa-firepower-flaws/

#CyberSecurity #Vulnerability #Infosec #Firepower

🚨 The Cybersecurity and Infrastructure Security Agency (#CISA) has flagged active attacks exploiting two critical flaws in #Cisco ASA and Firepower devices (CVE-2025-20362 + CVE-2025-20333) used in the #ArcaneDoor campaign.

Read: https://hackread.com/cisa-attacks-cisco-asa-firepower-flaws/

#CyberSecurity #Vulnerability #Infosec #Firepower

🚨 The Cybersecurity and Infrastructure Security Agency (#CISA) has flagged active attacks exploiting two critical flaws in #Cisco ASA and Firepower devices (CVE-2025-20362 + CVE-2025-20333) used in the #ArcaneDoor campaign.

Read: https://hackread.com/cisa-attacks-cisco-asa-firepower-flaws/

#CyberSecurity #Vulnerability #Infosec #Firepower

Cisco Firewall Zero-Days Exploited in China-Linked ArcaneDoor Attacks https://www.securityweek.com/cisco-firewall-zero-days-exploited-in-china-linked-arcanedoor-attacks/ #Vulnerabilities #ArcaneDoor #exploited #Featured #firewall #ZeroDay #China #Cisco

Cisco Firewall Zero-Days Exploited in China-Linked ArcaneDoor Attacks https://www.securityweek.com/cisco-firewall-zero-days-exploited-in-china-linked-arcanedoor-attacks/ #Vulnerabilities #ArcaneDoor #exploited #Featured #firewall #ZeroDay #China #Cisco

Cisco Firewall Zero-Days Exploited in China-Linked ArcaneDoor Attacks https://www.securityweek.com/cisco-firewall-zero-days-exploited-in-china-linked-arcanedoor-attacks/ #Vulnerabilities #ArcaneDoor #exploited #Featured #firewall #ZeroDay #China #Cisco

Cisco Firewall Zero-Days Exploited in China-Linked ArcaneDoor Attacks https://www.securityweek.com/cisco-firewall-zero-days-exploited-in-china-linked-arcanedoor-attacks/ #Vulnerabilities #ArcaneDoor #exploited #Featured #firewall #ZeroDay #China #Cisco

Cisco Firewall Zero-Days Exploited in China-Linked ArcaneDoor Attacks https://www.securityweek.com/cisco-firewall-zero-days-exploited-in-china-linked-arcanedoor-attacks/ #Vulnerabilities #ArcaneDoor #exploited #Featured #firewall #ZeroDay #China #Cisco

Cisco Firewall Zero-Days Exploited in China-Linked ArcaneDoor Attacks https://www.securityweek.com/cisco-firewall-zero-days-exploited-in-china-linked-arcanedoor-attacks/ #Vulnerabilities #ArcaneDoor #exploited #Featured #firewall #ZeroDay #China #Cisco

Cisco Firewall Zero-Days Exploited in China-Linked ArcaneDoor Attacks https://www.securityweek.com/cisco-firewall-zero-days-exploited-in-china-linked-arcanedoor-attacks/ #Vulnerabilities #ArcaneDoor #exploited #Featured #firewall #ZeroDay #China #Cisco

Cisco Firewall Zero-Days Exploited in China-Linked ArcaneDoor Attacks https://www.securityweek.com/cisco-firewall-zero-days-exploited-in-china-linked-arcanedoor-attacks/ #Vulnerabilities #ArcaneDoor #exploited #Featured #firewall #ZeroDay #China #Cisco

#ArcaneDoor - New #espionage -focused campaign found targeting perimeter network devices
#security

https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

#ArcaneDoor - New #espionage -focused campaign found targeting perimeter network devices
#security

https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

#ArcaneDoor - New #espionage -focused campaign found targeting perimeter network devices
#security

https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

#ArcaneDoor - New #espionage -focused campaign found targeting perimeter network devices
#security

https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

#ArcaneDoor - New #espionage -focused campaign found targeting perimeter network devices
#security

https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

Potential APT campaign targets network devices, exploiting vulnerabilities to deploy custom malware. Utilizing data exfiltration, lateral movement, and persistent access along with sophisticated in-memory techniques and crash dump hooks to evade detection. #CyberSecurity
#ArcaneDoor

https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

Potential APT campaign targets network devices, exploiting vulnerabilities to deploy custom malware. Utilizing data exfiltration, lateral movement, and persistent access along with sophisticated in-memory techniques and crash dump hooks to evade detection. #CyberSecurity
#ArcaneDoor

https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

Potential APT campaign targets network devices, exploiting vulnerabilities to deploy custom malware. Utilizing data exfiltration, lateral movement, and persistent access along with sophisticated in-memory techniques and crash dump hooks to evade detection. #CyberSecurity
#ArcaneDoor

https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

Potential APT campaign targets network devices, exploiting vulnerabilities to deploy custom malware. Utilizing data exfiltration, lateral movement, and persistent access along with sophisticated in-memory techniques and crash dump hooks to evade detection. #CyberSecurity
#ArcaneDoor

https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

Potential APT campaign targets network devices, exploiting vulnerabilities to deploy custom malware. Utilizing data exfiltration, lateral movement, and persistent access along with sophisticated in-memory techniques and crash dump hooks to evade detection. #CyberSecurity
#ArcaneDoor

https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

The Canadian Centre for Cyber Security has issued a detailed security advisory regarding the "LINE DANCER" & "LINE RUNNER" attacks against Cisco ASA devices by what it believes are nation-state sponsored malicious actors.

As usual, if you or your organization runs Cisco ASAs, time to patch to mitigate these vulnerabilities.

www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

#infosec #cybersecurity #LINEDANCER #LINERUNNER #ARCANEDOOR #Cisco #CiscoASA #SecurityAdvisory #CVE_2024_20359 #CVE_2024_20353

The Canadian Centre for Cyber Security has issued a detailed security advisory regarding the "LINE DANCER" & "LINE RUNNER" attacks against Cisco ASA devices by what it believes are nation-state sponsored malicious actors.

As usual, if you or your organization runs Cisco ASAs, time to patch to mitigate these vulnerabilities.

www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

#infosec #cybersecurity #LINEDANCER #LINERUNNER #ARCANEDOOR #Cisco #CiscoASA #SecurityAdvisory #CVE_2024_20359 #CVE_2024_20353

The Canadian Centre for Cyber Security has issued a detailed security advisory regarding the "LINE DANCER" & "LINE RUNNER" attacks against Cisco ASA devices by what it believes are nation-state sponsored malicious actors.

As usual, if you or your organization runs Cisco ASAs, time to patch to mitigate these vulnerabilities.

www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

#infosec #cybersecurity #LINEDANCER #LINERUNNER #ARCANEDOOR #Cisco #CiscoASA #SecurityAdvisory #CVE_2024_20359 #CVE_2024_20353

The Canadian Centre for Cyber Security has issued a detailed security advisory regarding the "LINE DANCER" & "LINE RUNNER" attacks against Cisco ASA devices by what it believes are nation-state sponsored malicious actors.

As usual, if you or your organization runs Cisco ASAs, time to patch to mitigate these vulnerabilities.

www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

#infosec #cybersecurity #LINEDANCER #LINERUNNER #ARCANEDOOR #Cisco #CiscoASA #SecurityAdvisory #CVE_2024_20359 #CVE_2024_20353

The Canadian Centre for Cyber Security has issued a detailed security advisory regarding the "LINE DANCER" & "LINE RUNNER" attacks against Cisco ASA devices by what it believes are nation-state sponsored malicious actors.

As usual, if you or your organization runs Cisco ASAs, time to patch to mitigate these vulnerabilities.

www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

#infosec #cybersecurity #LINEDANCER #LINERUNNER #ARCANEDOOR #Cisco #CiscoASA #SecurityAdvisory #CVE_2024_20359 #CVE_2024_20353

#Cisco Releases Security Updates Addressing #arcanedoor Vulnerabilities in Cisco Firewall Platforms

https://www.cisa.gov/news-events/alerts/2024/04/24/cisco-releases-security-updates-addressing-arcanedoor-vulnerabilities-cisco-firewall-platforms

#PatchYourShit

#Cisco Releases Security Updates Addressing #arcanedoor Vulnerabilities in Cisco Firewall Platforms

https://www.cisa.gov/news-events/alerts/2024/04/24/cisco-releases-security-updates-addressing-arcanedoor-vulnerabilities-cisco-firewall-platforms

#PatchYourShit

#Cisco Releases Security Updates Addressing #arcanedoor Vulnerabilities in Cisco Firewall Platforms

https://www.cisa.gov/news-events/alerts/2024/04/24/cisco-releases-security-updates-addressing-arcanedoor-vulnerabilities-cisco-firewall-platforms

#PatchYourShit

#Cisco Releases Security Updates Addressing #arcanedoor Vulnerabilities in Cisco Firewall Platforms

https://www.cisa.gov/news-events/alerts/2024/04/24/cisco-releases-security-updates-addressing-arcanedoor-vulnerabilities-cisco-firewall-platforms

#PatchYourShit

#Cisco Releases Security Updates Addressing #arcanedoor Vulnerabilities in Cisco Firewall Platforms

https://www.cisa.gov/news-events/alerts/2024/04/24/cisco-releases-security-updates-addressing-arcanedoor-vulnerabilities-cisco-firewall-platforms

#PatchYourShit

Cisco fixes firewall zero-days after likely nation-state hack
https://www.databreachtoday.com/cisco-fixes-firewall-0-days-after-likely-nation-state-hack-a-24934 #arcanedoor

Cisco fixes firewall zero-days after likely nation-state hack
https://www.databreachtoday.com/cisco-fixes-firewall-0-days-after-likely-nation-state-hack-a-24934 #arcanedoor

Cisco fixes firewall zero-days after likely nation-state hack
https://www.databreachtoday.com/cisco-fixes-firewall-0-days-after-likely-nation-state-hack-a-24934 #arcanedoor

Cisco fixes firewall zero-days after likely nation-state hack
https://www.databreachtoday.com/cisco-fixes-firewall-0-days-after-likely-nation-state-hack-a-24934 #arcanedoor

Cisco fixes firewall zero-days after likely nation-state hack
https://www.databreachtoday.com/cisco-fixes-firewall-0-days-after-likely-nation-state-hack-a-24934 #arcanedoor

Just a reminder that while we are up to 3 CVEs for the #Cisco #ArcaneDoor attack, we still don't know what the initial access to these devices was.

If I were a very strategic purchaser, I'd be thinking about what it would look like to replace any Cisco gear on my perimeter. Just in case.

blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

#CVE_2024_20353 #CVE_2024_20358 #CVE_2024_20359

Just a reminder that while we are up to 3 CVEs for the #Cisco #ArcaneDoor attack, we still don't know what the initial access to these devices was.

If I were a very strategic purchaser, I'd be thinking about what it would look like to replace any Cisco gear on my perimeter. Just in case.

blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

#CVE_2024_20353 #CVE_2024_20358 #CVE_2024_20359

Just a reminder that while we are up to 3 CVEs for the #Cisco #ArcaneDoor attack, we still don't know what the initial access to these devices was.

If I were a very strategic purchaser, I'd be thinking about what it would look like to replace any Cisco gear on my perimeter. Just in case.

blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

#CVE_2024_20353 #CVE_2024_20358 #CVE_2024_20359

Just a reminder that while we are up to 3 CVEs for the #Cisco #ArcaneDoor attack, we still don't know what the initial access to these devices was.

If I were a very strategic purchaser, I'd be thinking about what it would look like to replace any Cisco gear on my perimeter. Just in case.

blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

#CVE_2024_20353 #CVE_2024_20358 #CVE_2024_20359

'ArcaneDoor' #Cyberspies #Hacked #Cisco #Firewalls to Access Government Networks

Sources suspect #China is behind the targeted #exploitation of two zero-day #vulnerabilities in Cisco’s #security appliances.
#arcanedoor #privacy #0day #zeroday

https://www.wired.com/story/arcanedoor-cyberspies-hacked-cisco-firewalls-to-access-government-networks/

'ArcaneDoor' #Cyberspies #Hacked #Cisco #Firewalls to Access Government Networks

Sources suspect #China is behind the targeted #exploitation of two zero-day #vulnerabilities in Cisco’s #security appliances.
#arcanedoor #privacy #0day #zeroday

https://www.wired.com/story/arcanedoor-cyberspies-hacked-cisco-firewalls-to-access-government-networks/

'ArcaneDoor' #Cyberspies #Hacked #Cisco #Firewalls to Access Government Networks

Sources suspect #China is behind the targeted #exploitation of two zero-day #vulnerabilities in Cisco’s #security appliances.
#arcanedoor #privacy #0day #zeroday

https://www.wired.com/story/arcanedoor-cyberspies-hacked-cisco-firewalls-to-access-government-networks/

'ArcaneDoor' #Cyberspies #Hacked #Cisco #Firewalls to Access Government Networks

Sources suspect #China is behind the targeted #exploitation of two zero-day #vulnerabilities in Cisco’s #security appliances.
#arcanedoor #privacy #0day #zeroday

https://www.wired.com/story/arcanedoor-cyberspies-hacked-cisco-firewalls-to-access-government-networks/

'ArcaneDoor' #Cyberspies #Hacked #Cisco #Firewalls to Access Government Networks

Sources suspect #China is behind the targeted #exploitation of two zero-day #vulnerabilities in Cisco’s #security appliances.
#arcanedoor #privacy #0day #zeroday

https://www.wired.com/story/arcanedoor-cyberspies-hacked-cisco-firewalls-to-access-government-networks/

So, if you think you've maybe got #ArcaneDoor / #LineDancer issues on your ASA (discovery methods here: https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/), first things first:

DO NOT REBOOT OR CRASH DUMP YOUR DEVICE (sorry for shouting)

"When following these procedures first responders should NOT attempt to collect a core dump (Step 5) or reboot the device if they believe that the device has been compromised, based on the lina memory region output."

This thing runs in (hard to reach) memory, and hooks smartly, so it will be gone and your collection will have failed.

What you should do is (I'll quote):

1. Log in to the suspect device CLI. Note: On devices that are running Cisco FTD Software, change into the Cisco ASA CLI using the system support diagnostic-cli command.
2. Use the enable command to change into privileged EXEC mode.Note: On devices that are running Cisco FTD Software, the enable password is blank.
3. Collect the outputs of the following commands:
   • show version
   • verify /SHA-512 system:memory/text
   • debug menu memory 8
4. Open a case with the Cisco Technical Assistance Center (TAC, https://www.cisco.com/c/en/us/support/index.html). In the case, reference the keyword ArcaneDoor and upload the data that was collected in Step 3.

Secondly, although you should patch (after establishing you have not been compromised), the two patches mentioned won't protect you from the getting reinfected.

I will repeat (without shouting this time):

Patching is not a fix!

"We have not determined the initial access vector used in this campaign. We have not identified evidence of pre-authentication exploitation to date."

There did pop up a third CVE (#CVE_2024_20358) in between the Talos publication and the CISCO advisory page (https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_attacks_event_response), but it is also local (not "network"), so I guess that won't safe anyone from reinfection either. But that's just me guessing.

#CVE_2024_20359 #CVE_2024_20353 #infosec #cybersecurity

Final question for anyone still reading: why the debug menu memory 8? What does it do?

So, if you think you've maybe got #ArcaneDoor / #LineDancer issues on your ASA (discovery methods here: https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/), first things first:

DO NOT REBOOT OR CRASH DUMP YOUR DEVICE (sorry for shouting)

"When following these procedures first responders should NOT attempt to collect a core dump (Step 5) or reboot the device if they believe that the device has been compromised, based on the lina memory region output."

This thing runs in (hard to reach) memory, and hooks smartly, so it will be gone and your collection will have failed.

What you should do is (I'll quote):

1. Log in to the suspect device CLI. Note: On devices that are running Cisco FTD Software, change into the Cisco ASA CLI using the system support diagnostic-cli command.
2. Use the enable command to change into privileged EXEC mode.Note: On devices that are running Cisco FTD Software, the enable password is blank.
3. Collect the outputs of the following commands:
   • show version
   • verify /SHA-512 system:memory/text
   • debug menu memory 8
4. Open a case with the Cisco Technical Assistance Center (TAC, https://www.cisco.com/c/en/us/support/index.html). In the case, reference the keyword ArcaneDoor and upload the data that was collected in Step 3.

Secondly, although you should patch (after establishing you have not been compromised), the two patches mentioned won't protect you from the getting reinfected.

I will repeat (without shouting this time):

Patching is not a fix!

"We have not determined the initial access vector used in this campaign. We have not identified evidence of pre-authentication exploitation to date."

There did pop up a third CVE (#CVE_2024_20358) in between the Talos publication and the CISCO advisory page (https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_attacks_event_response), but it is also local (not "network"), so I guess that won't safe anyone from reinfection either. But that's just me guessing.

#CVE_2024_20359 #CVE_2024_20353 #infosec #cybersecurity

Final question for anyone still reading: why the debug menu memory 8? What does it do?

So, if you think you've maybe got #ArcaneDoor / #LineDancer issues on your ASA (discovery methods here: https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/), first things first:

DO NOT REBOOT OR CRASH DUMP YOUR DEVICE (sorry for shouting)

"When following these procedures first responders should NOT attempt to collect a core dump (Step 5) or reboot the device if they believe that the device has been compromised, based on the lina memory region output."

This thing runs in (hard to reach) memory, and hooks smartly, so it will be gone and your collection will have failed.

What you should do is (I'll quote):

1. Log in to the suspect device CLI. Note: On devices that are running Cisco FTD Software, change into the Cisco ASA CLI using the system support diagnostic-cli command.
2. Use the enable command to change into privileged EXEC mode.Note: On devices that are running Cisco FTD Software, the enable password is blank.
3. Collect the outputs of the following commands:
   • show version
   • verify /SHA-512 system:memory/text
   • debug menu memory 8
4. Open a case with the Cisco Technical Assistance Center (TAC, https://www.cisco.com/c/en/us/support/index.html). In the case, reference the keyword ArcaneDoor and upload the data that was collected in Step 3.

Secondly, although you should patch (after establishing you have not been compromised), the two patches mentioned won't protect you from the getting reinfected.

I will repeat (without shouting this time):

Patching is not a fix!

"We have not determined the initial access vector used in this campaign. We have not identified evidence of pre-authentication exploitation to date."

There did pop up a third CVE (#CVE_2024_20358) in between the Talos publication and the CISCO advisory page (https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_attacks_event_response), but it is also local (not "network"), so I guess that won't safe anyone from reinfection either. But that's just me guessing.

#CVE_2024_20359 #CVE_2024_20353 #infosec #cybersecurity

Final question for anyone still reading: why the debug menu memory 8? What does it do?

So, if you think you've maybe got #ArcaneDoor / #LineDancer issues on your ASA (discovery methods here: https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/), first things first:

DO NOT REBOOT OR CRASH DUMP YOUR DEVICE (sorry for shouting)

"When following these procedures first responders should NOT attempt to collect a core dump (Step 5) or reboot the device if they believe that the device has been compromised, based on the lina memory region output."

This thing runs in (hard to reach) memory, and hooks smartly, so it will be gone and your collection will have failed.

What you should do is (I'll quote):

1. Log in to the suspect device CLI. Note: On devices that are running Cisco FTD Software, change into the Cisco ASA CLI using the system support diagnostic-cli command.
2. Use the enable command to change into privileged EXEC mode.Note: On devices that are running Cisco FTD Software, the enable password is blank.
3. Collect the outputs of the following commands:
   • show version
   • verify /SHA-512 system:memory/text
   • debug menu memory 8
4. Open a case with the Cisco Technical Assistance Center (TAC, https://www.cisco.com/c/en/us/support/index.html). In the case, reference the keyword ArcaneDoor and upload the data that was collected in Step 3.

Secondly, although you should patch (after establishing you have not been compromised), the two patches mentioned won't protect you from the getting reinfected.

I will repeat (without shouting this time):

Patching is not a fix!

"We have not determined the initial access vector used in this campaign. We have not identified evidence of pre-authentication exploitation to date."

There did pop up a third CVE (#CVE_2024_20358) in between the Talos publication and the CISCO advisory page (https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_attacks_event_response), but it is also local (not "network"), so I guess that won't safe anyone from reinfection either. But that's just me guessing.

#CVE_2024_20359 #CVE_2024_20353 #infosec #cybersecurity

Final question for anyone still reading: why the debug menu memory 8? What does it do?

So, if you think you've maybe got #ArcaneDoor / #LineDancer issues on your ASA (discovery methods here: https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/), first things first:

DO NOT REBOOT OR CRASH DUMP YOUR DEVICE (sorry for shouting)

"When following these procedures first responders should NOT attempt to collect a core dump (Step 5) or reboot the device if they believe that the device has been compromised, based on the lina memory region output."

This thing runs in (hard to reach) memory, and hooks smartly, so it will be gone and your collection will have failed.

What you should do is (I'll quote):

1. Log in to the suspect device CLI. Note: On devices that are running Cisco FTD Software, change into the Cisco ASA CLI using the system support diagnostic-cli command.
2. Use the enable command to change into privileged EXEC mode.Note: On devices that are running Cisco FTD Software, the enable password is blank.
3. Collect the outputs of the following commands:
   • show version
   • verify /SHA-512 system:memory/text
   • debug menu memory 8
4. Open a case with the Cisco Technical Assistance Center (TAC, https://www.cisco.com/c/en/us/support/index.html). In the case, reference the keyword ArcaneDoor and upload the data that was collected in Step 3.

Secondly, although you should patch (after establishing you have not been compromised), the two patches mentioned won't protect you from the getting reinfected.

I will repeat (without shouting this time):

Patching is not a fix!

"We have not determined the initial access vector used in this campaign. We have not identified evidence of pre-authentication exploitation to date."

There did pop up a third CVE (#CVE_2024_20358) in between the Talos publication and the CISCO advisory page (https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_attacks_event_response), but it is also local (not "network"), so I guess that won't safe anyone from reinfection either. But that's just me guessing.

#CVE_2024_20359 #CVE_2024_20353 #infosec #cybersecurity

Final question for anyone still reading: why the debug menu memory 8? What does it do?

Cisco Raises Alarm for ‘ArcaneDoor’ Zero-Days Hitting ASA Firewall Platforms https://www.securityweek.com/cisco-raises-alarm-for-arcanedoor-zero-days-hitting-asa-firewall-platforms/ #NetworkSecurity #Vulnerabilities #Nation-State #ArcaneDoor #CiscoTalos #ChinaAPT #CiscoASA

Cisco Raises Alarm for ‘ArcaneDoor’ Zero-Days Hitting ASA Firewall Platforms https://www.securityweek.com/cisco-raises-alarm-for-arcanedoor-zero-days-hitting-asa-firewall-platforms/ #NetworkSecurity #Vulnerabilities #Nation-State #ArcaneDoor #CiscoTalos #ChinaAPT #CiscoASA

Cisco Raises Alarm for ‘ArcaneDoor’ Zero-Days Hitting ASA Firewall Platforms https://www.securityweek.com/cisco-raises-alarm-for-arcanedoor-zero-days-hitting-asa-firewall-platforms/ #NetworkSecurity #Vulnerabilities #Nation-State #ArcaneDoor #CiscoTalos #ChinaAPT #CiscoASA

Cisco Raises Alarm for ‘ArcaneDoor’ Zero-Days Hitting ASA Firewall Platforms https://www.securityweek.com/cisco-raises-alarm-for-arcanedoor-zero-days-hitting-asa-firewall-platforms/ #NetworkSecurity #Vulnerabilities #Nation-State #ArcaneDoor #CiscoTalos #ChinaAPT #CiscoASA

Cisco Raises Alarm for ‘ArcaneDoor’ Zero-Days Hitting ASA Firewall Platforms https://www.securityweek.com/cisco-raises-alarm-for-arcanedoor-zero-days-hitting-asa-firewall-platforms/ #NetworkSecurity #Vulnerabilities #Nation-State #ArcaneDoor #CiscoTalos #ChinaAPT #CiscoASA

Cisco Raises Alarm for ‘ArcaneDoor’ Zero-Days Hitting ASA Firewall Platforms https://www.securityweek.com/cisco-raises-alarm-for-arcanedoor-zero-days-hitting-asa-firewall-platforms/ #NetworkSecurity #Vulnerabilities #Nation-State #ArcaneDoor #CiscoTalos #ChinaAPT #CiscoASA