Line Runner — Malware Profile

Line Runner is a persistent backdoor and web shell allowing threat actors to upload and execute arbitrary Lua scripts. Line Runner is associated with the ArcaneDoor campaign.

MITRE ATT&CK techniques (8)

• T1027.015 Compression
• T1041 Exfiltration Over C2 Channel
• T1059.011 Lua
• T1070.004 File Deletion
• T1071.001 Web Protocols
• T1505.003 Web Shell
• T1557 Adversary-in-the-Middle
• T1653 Power Settings

Read the full analysis on IntelFusions