Line Dancer
In-memory implant planted on Cisco ASA firewalls in the ArcaneDoor campaign.
Each of Cisco's September 2026 additions to the US exploited-flaw list, which took the company to 100 entries on 30 September, was a security product. Line Dancer, found on ASA firewalls in the 2024 ArcaneDoor campaign, is the precedent for that target.
Last refreshed: 12 October 2026
How did Line Dancer hide inside Cisco firewalls?
Timeline for Line Dancer
Named as Line Dancer
Cybersecurity: Threats and Defences: Mentioned in: Cisco reaches 100 entries on CISA's listBackground
Line Dancer is a shellcode interpreter that ran only in memory on Cisco ASA firewalls. Cisco Talos disclosed it in April 2024 as part of ArcaneDoor, a campaign against government networks with activity concentrated between December 2023 and early January 2024.
The attackers fed Line Dancer their code through the host-scan-reply field, which ASA devices process while setting up a VPN session, and it ran whatever they uploaded. Talos tracks the operator as UAT4356 and called it a sophisticated state-sponsored actor; Microsoft's name for the same group is STORM-1849.
A reboot wiped Line Dancer, because it never touched disk. The ArcaneDoor operators relied on a companion implant, Line Runner, to keep their foothold.