Do Son NCSC exposes RayInitiator, a bootkit for Cisco ASA 5500-X devices without Secure Boot, which deploys the LINE VIPER shellcode loader for persistent and stealthy attacks.
ArcaneDoor
Cisco Talos have unveiled a coordinated threat actor campaign dubbed "ArcaneDoor," targeting government-owned network devices globally
Cisco has identified two vulnerabilities that were abused in the ArcaneDoor campaign (CVE-2024-20353 and CVE-2024-20359).