Line Dancer
Software · ATTACK:enterprise:S1186
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1186",
"title": "Line Dancer",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1186",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--4c8ad4ed-3bbb-4088-bf14-f4caf2bf62a0",
"external_id": "S1186",
"domain": "enterprise",
"created": "2025-01-06T16:31:21.533Z",
"modified": "2025-04-15T19:46:34.123Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "CCCS ArcaneDoor 2024",
"url": "https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns"
},
{
"source_name": "Cisco ArcaneDoor 2024",
"url": "https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/"
}
]
}Explicit source assertions (10)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0046 → uses → ATTACK:enterprise:S1186
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19b6ad5a-3a22-434f-a04c-a49fa2c0f307
CCCS ArcaneDoor 2024 · Cisco ArcaneDoor 2024ATTACK:enterprise:S1186 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20c3b1d7-7702-4a0b-9902-dece6e413bf1
CCCS ArcaneDoor 2024ATTACK:enterprise:S1186 → uses → ATTACK:enterprise:T1690
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--292a4dcb-8bf9-424c-a254-5e4ce33e6bae
Cisco ArcaneDoor 2024ATTACK:enterprise:S1186 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3d9c09bd-5b67-40dc-9144-1dc537933865
Cisco ArcaneDoor 2024ATTACK:enterprise:S1186 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91730e03-6601-4203-8c00-3f595cce7d7d
CCCS ArcaneDoor 2024 · Cisco ArcaneDoor 2024ATTACK:enterprise:S1186 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95283b95-4474-47ac-9e77-a1f4da968f9f
Cisco ArcaneDoor 2024ATTACK:enterprise:S1186 → uses → ATTACK:enterprise:T1653
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8c261d2-6c16-471b-80fc-d2a2e4d28f31
Cisco ArcaneDoor 2024ATTACK:enterprise:S1186 → uses → ATTACK:enterprise:T1040
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bca32067-c031-46fd-83dd-c1b33994d16e
Cisco ArcaneDoor 2024ATTACK:enterprise:S1186 → uses → ATTACK:enterprise:T1059.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c0369434-f35a-40e9-bd2e-21bba4ca20f7
CCCS ArcaneDoor 2024 · Cisco ArcaneDoor 2024ATTACK:enterprise:S1186 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e452a193-b1a0-40b6-af3e-a734859fcf0b
Cisco ArcaneDoor 2024