New espionage-focused campaign found targeting perimeter network devices
released on 2024-04-24 @ 05:07:39 PM
The report discusses a sophisticated, state-sponsored espionage campaign named ArcaneDoor, which targeted perimeter network devices from multiple vendors. The actors employed bespoke malware tools, including Line Runner and Line Dancer, to gain persistent access, conduct reconnaissance, capture network traffic, and potentially move laterally within compromised networks. The report details the technical aspects of the malware, the attack chain, anti-forensic techniques used by the threat actors, and provides recommendations for detecting and mitigating the threat.