ArcaneDoorThreat actor
ArcaneDoor is a campaign that is the latest example of state-sponsored actors targeting perimeter network devices from multiple vendors. Coveted by these actors, perimeter network devices are the perfect intrusion point for espionage-focused campaigns.From MISP Galaxy
Last reported 27 days ago, by CERT-EU2 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1036Masquerading
“Attributed to threat actor idbzoomh, the campaign used a malicious archive masquerading as leaked source code to deliver Vidar v18.7, an information stealer, and GhostSocks, a SOCKS proxy trojan.”
- T1110Brute Force
“We observed infrastructure overlap between recent Cisco ASA scanning, Palo login attempts, and Fortinet brute force attempts:”
- T1195Supply Chain Compromise
“On April 25, a supply-chain compromise reportedly targeted the elementary-data project, where a forged release was published to PyPI and a matching trojanised container image was pushed to the GitHub Container Registry.”
- T1555.005Password Managers
“The campaign impersonated legitimate developer tooling to deliver RAT-enabled infostealers targeting credentials, browser data, password managers, and cryptocurrency wallets.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Cyber Brief 26-05 - April 2026“…twork perimeter security appliances globally and may support espionage operations, following earlier reporting linking UAT-4356 to the ArcaneDoor campaign.”
-
25,000 IPs Scanned Cisco ASA Devices — New Vulnerability Potentially Incoming“Espionage: The ArcaneDoor campaign used two zero-days in Cisco ASA (Line Dancer, Line Runner) to infiltrate government networks.”
Thanks — we review every report.