A state-sponsored threat actor group has apparently leveraged two zero-day vulnerabilities in Cisco Adaptive Security Appliances (ASA) to gain access to government systems and conduct espionage. Cisco is calling the campaign ArcaneDoor and based on the sophistication of the attacks their security division, Talos, believes it to be a state-sponsored group they are calling UAT4356. The campaign appears to have started as early as November 2023.
The combination of the two vulnerabilities allowed threat actors to run malicious code in memory, spy on network traffic, steal data, and maintain access after a reboot of the device.
Indications Of Compromise (IOCs) are available in the Cisco Talos blog linked below.
More info below!
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20353