H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Line Dancer

[Line Dancer](https://attack.mitre.org/software/S1186) is a memory-only Lua-based shellcode loader associated with the [ArcaneDoor](https://attack.mitre.org/campaigns/C0046) campaign. [Line Dancer](https://attack.mitre.org/software/S1186) allows an adversary to upload and execute arbitrary shellcode on victim devices.(Citation: Cisco ArcaneDoor 2024)(Citation: CCCS ArcaneDoor 2024)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Line Dancer](https://attack.mitre.org/software/S1186) is a memory-only Lua-based shellcode loader associated with the [ArcaneDoor](https://attack.mitre.org/campaigns/C0046) campaign. [Line Dancer](https://attack.mitre.org/software/S1186) allows an adversary to upload and execute arbitrary shellcode on victim devices.(Citation: Cisco ArcaneDoor 2024)(Citation: CCCS ArcaneDoor 2024)

Labels

malware
10 recorded

Relationships

uses
from ArcaneDoor
Campaign
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Exfiltration Over C2 Channel
Technique
uses
to Network Device CLI
Technique
uses
to Network Sniffing
Technique
uses
to Power Settings
Technique
uses
to Prevent Command History Logging
Technique
uses
to Rootkit
Technique
uses
to System Information Discovery
Technique
uses
to Web Protocols
Technique
3 external

References

mitre-attack
S1186
open
CCCS ArcaneDoor 2024
https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns
open
Cisco ArcaneDoor 2024
https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance