Cisco Fixes Firewall 0-Days After Likely Nation-State Hack

Probable nation-state hackers targeted Cisco firewall appliances in a campaign dating to late 2023, the networking giant disclosed Wednesday.

See Also: Enabling Government for Modernized IT

The company released three patches – two of them rated critical – for devices running Adaptive Security Appliance and Cisco Firepower Threat Defense software. Cisco said it spotted hackers implanting malware and potentially stealing data from infected devices. It dubbed the campaign “Arcane Door.”

Cisco didn’t connect the hackers with a specific country and said the threat actor behind the attacks doesn’t match already-known groups. Cisco Talos, the company’s cybersecurity subsidiary, now tracks the hacking group as UAT4356. Microsoft looks for its activities under the STORM-1849 moniker.

“This actor utilized bespoke tooling that demonstrated a clear focus on espionage and an in-depth knowledge of the devices that they targeted, hallmarks of a sophisticated state-sponsored actor,” says a Talos blog post on the campaign.

Threat intelligence analysts have attributed a general rise in network edge device hacking to Russian and Chinese intelligence agencies (see: State Hackers’ New Frontier: Network Edge Devices).

Talos said the campaign affected “a small set of customers,” all of which involved government networks. The company began investigating the campaign after receiving a tip from a victim. How exactly hackers penetrated the networks is unknown. The investigation did find evidence suggesting hackers began developing and testing the attack in July. By November, they stood up infrastructure and moved from testing into production – leading to the first victim coming forward in early January.

The two critical vulnerabilities, tracked as CVE-2024-20353 and CVE-2024-20359, don’t have workarounds, meaning Cisco recommends system administrators patch immediately. The first flaw stems from an “incomplete error checking when parsing an HTTP header.” Attackers sending a specific HTTP request to a Cisco device can force it to reload unexpectedly. Cisco describes the second flaw as a “vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins.” Its exploitation allows attackers to gain root-level privileges, although they already need administrator-level privileges for the attack to be successful.

Talos said attackers deployed two malware implants after executing the attack. One, dubbed “Line Dancer,” is a memory-only implant that allows attackers to upload and executive shellcode payloads. Attackers used it to capture internet traffic and to cover their tracks by disabling logging and skipping the generation of forensics data through a crash dump when the system reboots. The other, “Line Runner,” is a backdoor for gaining persistence.

Network edge devices, Talos said, “need to be routinely and promptly patched.”