Line Runner
Persistent backdoor planted on Cisco ASA firewalls in the ArcaneDoor campaign.
Cisco reached 100 entries on CISA's exploited-flaw list on 30 September 2026, every September listing hitting a security product; Line Runner, the ArcaneDoor firewall backdoor found in April 2024, is the precedent for that pattern.
Last refreshed: 12 October 2026
How did Line Runner survive reboots on Cisco firewalls?
Timeline for Line Runner
Named as Line Runner
Cybersecurity: Threats and Defences: Mentioned in: Cisco reaches 100 entries on CISA's listBackground
Line Runner is a persistent backdoor that Cisco Talos found on Cisco ASA firewalls during the ArcaneDoor campaign, disclosed in April 2024. ArcaneDoor remains the standing example of attackers turning Cisco's own security appliances against their owners.
According to Talos, Line Runner abused an old ASA feature meant for pre-loading VPN clients. When the firewall boots, it unzips a matching file from disk0: and executes a Lua script inside it, so the implant survives a restart. Cisco tracked the weakness as CVE-2024-20359, and CISA listed it as exploited, together with CVE-2024-20353, on 24 April 2024.
Line Runner worked alongside Line Dancer, a second implant that lived only in memory and gave the actor, labelled UAT4356, its day-to-day access to compromised ASA devices.