Changelog: ArcaneDoor campaign targets Cisco devices

Published:

April 25, 2024

Massimo Botturi / Unsplash

Welcome to Changelog for 4/25/2024, published by Synack! README senior editor Nathaniel Mott here with all the doom and gloom you need this fine Spring day.

The payload

Cisco Talos revealed on April 24 a campaign it’s dubbed “ArcaneDoor” in which “a previously unknown actor now tracked as UAT4356 by Talos and STORM-1849 by the Microsoft Threat Intelligence Center” was said to have “utilized bespoke tooling that demonstrated a clear focus on espionage and an in-depth knowledge of the devices that they targeted”—those being “perimeter network devices” from Cisco, Microsoft and other vendors—which Talos called “hallmarks of a sophisticated state-sponsored actor.”

Cisco has identified three vulnerabilities related to ArcaneDoor: CVE-2024-20353 and CVE-2024-20359, both of which are known to have been actively exploited, and CVE-2024-20358. Talos said it has “been unable to identify the initial attack vector,” though, so the number of Cisco-related vulns associated with the campaign might continue to grow. Talos also said “network telemetry and information from intelligence partners indicate the actor is interested in—and potentially attacking—network devices from Microsoft and other vendors” so we might end up seeing a few reports from those companies as well.

Talos said it believes UAT4356 started “developing and testing” the attacks used in ArcaneDoor around July 2023 before standing up its infrastructure and performing “some activity” in December 2023. Activity was first confirmed in January, more compromised devices were found in February and then patches for the associated CVEs were released in “late March / early April.” Talos said it received assistance in its investigation from government organizations in the U.S., U.K., Canada and Australia as well as the Microsoft Threat Intelligence Center and Black Lotus Labs at Lumen Technologies.

As for ArcaneDoor’s targets: Talos said all of the victims “involved government networks globally.” It didn’t say which governments, but I’d probably start my guessing with the four countries listed above. The group also didn’t publicly attribute the activity to a particular country, although Wired reported that “sources familiar with the investigation” said it “appears to be aligned with China's state interests.” (Which based on the near-constant reports of Chinese espionage from countries around the world appear to include “spying on pretty much every government that isn’t called the People’s Republic of China.”)

This would also fit China’s style. Recorded Future reported in November 2023 that China-linked adversaries have become increasingly fond of targeting “public-facing security and network appliances” like the ones exploited as part of this campaign. Chinese threat actors aren’t alone in this—we reported in July 2023 that attackers seemed to have renewed interest in compromising edge devices, which have proven difficult to defend, especially since organizations typically have very little visibility into what’s happening on the perimeters of their networks—but they do seem to be particularly fond of these targets.

None of which is likely to comfort organizations targeted in campaigns like ArcaneDoor. So far it seems like Cisco will be able to patch its way to better security, which puts its customers in a better position than the Barracuda users who had to remove the company’s email security gateway appliances from their networks entirely in June 2023, but that might change after the initial attack vector is discovered. And it’s not like the alternatives fare much better—are Cisco users supposed to switch to Ivanti? Juniper Networks? Fortinet? Palo Alto Networks? They’re going to be “living on the edge,” as it were, no matter what.

The week, compiled

Here’s some of the week’s leading security news:

Mandiant: M-Trends 2024 arrived on April 23. The annual report summarizes Mandiant’s observations from throughout 2023, including how long hackers tend to dwell on networks, what kinds of malware they’re using, etc. If you don’t feel like giving your contact information to Google Cloud (which owns Mandiant) you can find the full report here. Just don’t tell anyone I sent you. Mandiant also published “Poll Vaulting: Cyber Threats to Global Elections” today, which you can find on the Google Cloud website.

BleepingComputer: It turns out using antivirus software to distribute malware is about as amusing as it is effective. Avast said this week that eScan’s update mechanisms—which transferred data via HTTP and apparently didn’t require updates to be signed—have been used by North Korean hackers “to plant backdoors on big corporate networks and deliver cryptocurrency miners through GuptiMiner malware.”

Ars Technica: Microsoft revealed on April 22 that “Kremlin-backed hackers have been exploiting a critical Microsoft vulnerability for four years in attacks that targeted a vast array of organizations with a previously undocumented tool.” Ars Technica noted that although the vuln was patched in 2022, Microsoft didn’t say and, in fact, still hasn’t said anything in the associated advisory about it being actively exploited.

Off-script

I don’t have the heart to continue writing about the TikTok ban now that it’s been passed and signed by President Joe Biden. (Whose campaign, somewhat hypocritically, will continue to use the platform.) I’d rather make note of what strikes me as a positive change: Tinder’s new “Share My Date” feature.

Good Faces Agency / Unsplash

TechCrunch reported on April 22 that Tinder users “will now be able to send a link that includes details about the upcoming date, including the match’s name, meeting location, date, and time.” Many people already share this kind of information with someone they trust before they meet up with a stranger, but it’s nice to see Tinder officially support the practice and simultaneously make it more convenient than before.

I’m sure that someone will find a way to abuse this feature and that Tinder has some flaws that I’m not aware of. That’s how things usually go. But I figure it’s worth taking a moment to savor the small victories making people at least a little bit safer. Hopefully similar apps follow suit.