Cyber Resilience

Campaign · all campaigns

ArcaneDoorC0046 unknown

aka ArcaneDoor

Last updated: 2026-08-20

2attributed CVEs
30ATT&CK techniques
8.6IDF score (tooling uniqueness)
2exclusive CVEs
2018–2025years active

About this actor

ArcaneDoor is a campaign that is the latest example of state-sponsored actors targeting perimeter network devices from multiple vendors. Coveted by these actors, perimeter network devices are the perfect intrusion point for espionage-focused campaigns. As a critical path for data into and out of the network, these devices need to be routinely and promptly patched; using up-to-date hardware and software versions and configurations; and be closely monitored from a security perspective. Gaining a foothold on these devices allows an actor to directly pivot into an organization, reroute or modify traffic and monitor network communications. In the past two years, we have seen a dramatic and sustained increase in the targeting of these devices in areas such as telecommunications providers and energy sector organizations — critical infrastructure entities that are likely strategic targets of interest for many foreign governments.

Source: MITRE ATT&CK

How we know this

Data origin
MITRE ATT&CK campaign Imported from the MITRE ATT&CK STIX bundle as a campaign object.
Techniques
MITRE ATT&CK STIX mappings — 30 ATT&CK techniques on file.
Named victims
None on file.

See how actor data is built for the full pipeline.

Activity timeline

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2018-0101 10.010.00.93172018-01-29see CVE
CVE-2025-20363 7.19.00.07522025-09-25see CVE

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
SI-419 / 3063%
CM-616 / 3053%
CM-215 / 3050%
CM-715 / 3050%
CA-713 / 3043%
SI-313 / 3043%
AC-311 / 3037%
SI-711 / 3037%
AC-69 / 3030%
SC-79 / 3030%
AC-28 / 3027%
AC-48 / 3027%
AC-177 / 3023%
IA-27 / 3023%
AC-56 / 3020%

Co-occurring actors

None.

Similar actors

Similar TTPs

Active in same years