H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Line Runner

[Line Runner](https://attack.mitre.org/software/S1188) is a persistent backdoor and web shell allowing threat actors to upload and execute arbitrary Lua scripts. [Line Runner](https://attack.mitre.org/software/S1188) is associated with the [ArcaneDoor](https://attack.mitre.org/campaigns/C0046) campaign.(Citation: CCCS ArcaneDoor 2024)(Citation: Cisco ArcaneDoor 2024)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Line Runner](https://attack.mitre.org/software/S1188) is a persistent backdoor and web shell allowing threat actors to upload and execute arbitrary Lua scripts. [Line Runner](https://attack.mitre.org/software/S1188) is associated with the [ArcaneDoor](https://attack.mitre.org/campaigns/C0046) campaign.(Citation: CCCS ArcaneDoor 2024)(Citation: Cisco ArcaneDoor 2024)

Labels

malware
9 recorded

Relationships

uses
from ArcaneDoor
Campaign
uses
to Adversary-in-the-Middle
Technique
uses
to Compression
Technique
uses
to Exfiltration Over C2 Channel
Technique
uses
to File Deletion
Technique
uses
to Lua
Technique
uses
to Power Settings
Technique
uses
to Web Protocols
Technique
uses
to Web Shell
Technique
3 external

References

mitre-attack
S1188
open
CCCS ArcaneDoor 2024
https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns
open
Cisco ArcaneDoor 2024
https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance