UAT4356 (aka STORM-1849) has been exploiting two zero-day vulnerabilities in ASA and FTD firewalls since November 2023 to breach government networks worldwide. Cisco Talos researchers tracked this cyber-espionage campaign as ArcaneDoor. Early in 2024, a customer contacted Cisco to report a suspicious related to its Cisco Adaptive Security Appliances (ASA)