Line RunnerMalware
Line Runner is a persistent backdoor and web shell allowing threat actors to upload and execute arbitrary Lua scripts. Line Runner is associated with the ArcaneDoor campaign.From MITRE ATT&CK
Last reported 13 months ago, by GreyNoise1 report
ATT&CK techniques
1 technique · each with the sentence it comes from- T1110Brute Force
“We observed infrastructure overlap between recent Cisco ASA scanning, Palo login attempts, and Fortinet brute force attempts:”
What the reports say
1 report, newest first · the exact sentence from each-
25,000 IPs Scanned Cisco ASA Devices — New Vulnerability Potentially Incoming“Espionage: The ArcaneDoor campaign used two zero-days in Cisco ASA (Line Dancer, Line Runner) to infiltrate government networks.”
Thanks — we review every report.