Threat Actors Storm-1849

Storm-1849

TLP:CLEAR

Active

Kill Chain Analysis Generate Graph Hunt Package

Also known as: UAT4356, UAT4356 by Talos, CVE-2025-20333, CVE-2025-20362, CVE-2025-20363, STATIC TUNDRA, Sandworm Team, CovertNetwork-1658, the 7777 Botnet, CVE-2024-39717, Royal Ransomware, BlackCat, Gookee, kapuchin0, Guki, leaked the source code, shut the operation down

Description

UAT4356 is a state-sponsored threat actor that targeted government networks globally through a campaign named ArcaneDoor. They exploited two zero-day vulnerabilities in Cisco Adaptive Security Appliances to deploy custom malware implants called "Line Runner" and "Line Dancer." The actor demonstrated a deep understanding of Cisco systems, utilized anti-forensic measures, and took deliberate steps to evade detection. UAT4356's sophisticated attack chain allowed them to conduct malicious actions such as configuration modification, reconnaissance, network traffic capture/exfiltration, and potentially lateral movement on compromised devices.

Goals & Targeting

Targeted Sectors

Government

Financial services

Energy

Telecommunications

Defense

Healthcare

Critical infrastructure

Education

Manufacturing

Maritime

Aviation

Transportation

Information technology

Media

Hospitality

Non profit

Aerospace

Construction

Retail

Chemical

Think tank

Nuclear

Oil gas

Legal services

Entertainment

Gaming

Food agriculture

Targeted Countries / Regions

AI Analysis

· 1 week ago

Executive Summary

Storm-1849, also known as UAT4356, is a state-sponsored threat actor identified through their involvement in the ArcaneDoor campaign. They exploit zero-day vulnerabilities in Cisco Adaptive Security Appliances to deploy custom malware, demonstrating advanced capabilities and targeting government networks globally.

Goals & Targeting

Storm-1849 likely aims to gather sensitive information for espionage or disrupt operations within targeted governments and technology sectors. Their global reach suggests a broad interest in critical national infrastructure data。

Enhanced Description

Storm-1849 (alias: UAT4356) operates with high technical sophistication, focusing on state-sponsored activities. Their primary attack vector involves exploiting zero-day vulnerabilities in Cisco ASA systems, deploying custom malware named Line Runner and Line Dancer. These tools allow them to perform network reconnaissance, data exfiltration, and lateral movement while evading detection through anti-forensic measures. Targeting critical infrastructure and government sectors globally, their operations highlight a strategic focus on persistent access and intelligence gathering.

Key Capabilities

Exploitation of zero-day vulnerabilities
Deployment of custom malware (Line Runner, Line Dancer)
Anti-forensic tools to avoid detection
Network traffic analysis
Lateral movement within networks

MITRE ATT&CK Tactics

Persistence

Exfiltration

Clandestine Communication

ATT&CK Techniques

T1539.002

T1569.004

Software / Tooling

Line Runner

Line Dancer

Campaigns & Victims

The ArcaneDoor campaign showcases Storm-1849's ability to launch prolonged and stealthy attacks on government networks, emphasizing their capability for persistent access and data theft. Their use of sophisticated techniques indicates a high level of resource and expertise.

IOC Patterns

Network traffic anomalies from Cisco ASA devices
Presence of custom malware binaries
Scheduled tasks indicative of persistence mechanisms

Recommended Actions

Patch and update Cisco ASA systems to mitigate known vulnerabilities
Implement network monitoring for unusual traffic patterns
Enhance detection capabilities for lateral movement activities
Conduct regular security audits focusing on critical infrastructure

Suggested Tags

APT

State-sponsored

Critical Infrastructure Attacks

Government Targeting

Confidence Assessment

The analysis is based on detailed operational data and observed TTPs, providing a high confidence in their APT classification. Gaps include exact targets beyond 'globally' and specific attack timeline details outside 2023.