Loading malware…
COATHANGER is a custom remote-access trojan targeting Fortinet FortiGate appliances running FortiOS. It was used in Chinese state-sponsored cyber-espionage activity, including the 2023 compromise of a segmented Dutch Ministry of Defence network. Initial deployment followed exploitation of the FortiOS SSL-VPN vulnerability CVE-2022-42475, including exploitation before public disclosure. The implant establishes durable access that can survive device reboots and firmware upgrades by reinfecting the reboot-related process. It conceals its installation in a hidden directory and intercepts system calls to hide artifacts. COATHANGER includes functionality to inject a library into a running process and hook an existing function, supporting stealthy execution. It communicates with command-and-control infrastructure over SSL and uses ICMP to exchange configuration information. Its initial stage is packed, and it can remove files following operations, further impeding forensic investigation. Victim targeting associated with the campaign includes governments, international organizations, defense-sector entities, critical infrastructure, service providers, consultancies, and manufacturing organizations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
De statelijke actor verkreeg in 2022 en 2023 binnen enkele maanden toegang tot ten minste 20.000 FortiGate-systemen wereldwijd middels CVE-2022-42475. De actor kende de kwetsbaarheid minstens twee maanden vóór Fortinet deze openbaar maakte; gedurende deze zero-dayperiode werden 14.000 apparaten geïnfecteerd. | Het rapport beschrijft de geavanceerde COATHANGER-malware gericht op FortiGate-systemen. De statelijke actor installeerde de malware bij relevante doelwitten om permanente toegang tot systemen te verkrijgen, ook nadat FortiGate-beveiligingsupdates waren geïnstalleerd.
Agrius exploits public-facing applications for initial access to victim environments. Examples include widespread attempts to exploit CVE-2018-13379 in FortiOS devices... APT29 has exploited ... CVE-2018-13379 for FortiGate VPNs... Dragonfly ... exploited ... CVE-2018-13379 for Fortinet VPNs... Magic Hound ... exploited ... Fortios SSL VPNs (CVE-2018-13379). Play ... including CVE-2018-13379 ... in FortiOS.
...the Chinese Volt Typhoon hacking group exploited two FortiOS vulnerabilities (tracked as CVE-2023-27997 and CVE-2022-42475) to deploy Coathanger remote access trojan malware...
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In February 2024, the service revealed that Chinese hackers had broken into a compartmentalized Dutch Ministry of Defence network by exploiting a FortiGate vulnerability, deploying malware the agencies named COATHANGER.
In February 2024, the service revealed that Chinese hackers had broken into a compartmentalized Dutch Ministry of Defence network by exploiting a FortiGate vulnerability, deploying malware the agencies named COATHANGER.
"...attackers exploited CVE-2022-42475 against a Fortigate device to gain initial access and deploy malware known as \"COATHANGER.\""
This sample contained an interesting string that led one of our CERT partners to name this cluster COATHANGER “She took his coat and hung it up.”
28 distinct techniques documented for this family, organized by ATT&CK tactic.
De campagne richtte zich op FortiGate-systemen en het NCSC beschrijft een bredere trend van misbruik van publiek benaderbare edge devices, zoals firewalls, VPN-servers, routers en e-mailservers.
De statelijke actor verkreeg in 2022 en 2023 toegang tot ten minste 20.000 FortiGate-systemen wereldwijd middels CVE-2022-42475, waaronder gedurende een zero-dayperiode vóór openbare bekendmaking. | Minimaal twee maanden voordat Fortinet de kwetsbaarheid bekend maakte, was de actor hiervan al op de hoogte. Tijdens deze ‘zero-day’-periode infecteerde de actor alleen al 14.000 apparaten.
Fortinet disclosed in February that the Chinese Volt Typhoon hacking group exploited two FortiOS SSL VPN flaws (CVE-2022-42475 and CVE-2023-27997) to backdoor a Dutch Ministry of Defence military network using custom Coathanger remote access trojan (RAT) malware.
De campagne richtte zich op FortiGate-systemen en het NCSC beschrijft een bredere trend van misbruik van publiek benaderbare edge devices, zoals firewalls, VPN-servers, routers en e-mailservers.
Fortinet disclosed in February that the Chinese Volt Typhoon hacking group exploited two FortiOS SSL VPN flaws (CVE-2022-42475 and CVE-2023-27997) to backdoor a Dutch Ministry of Defence military network using custom Coathanger remote access trojan (RAT) malware.
The content repeatedly describes adversaries and malware injecting code, shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, wuauclt.exe, lsass.exe, and browser processes.
Silence has injected a DLL library containing a Trojan into the fwmain32.exe process. WarzoneRAT has the ability to inject malicious DLLs into a specific process for privilege escalation. COATHANGER includes a binary labeled authd that can inject a library into a running process and then hook an existing function within that process with a new function from that library.
The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.
The content repeatedly describes adversaries and malware injecting code, shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, wuauclt.exe, lsass.exe, and browser processes.
Silence has injected a DLL library containing a Trojan into the fwmain32.exe process. WarzoneRAT has the ability to inject malicious DLLs into a specific process for privilege escalation. COATHANGER includes a binary labeled authd that can inject a library into a running process and then hook an existing function within that process with a new function from that library.
Examples throughout the content include deleting tools, logs, malware-related files, staged archives, screenshots, temporary files, and exfiltrated data 'to cover their tracks,' 'reduce their footprint,' 'remove traces of activity,' or as part of 'post-intrusion cleanup.'
The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
De statelijke actor installeerde bij relevante doelwitten op een later moment malware. Zo kreeg de actor permanente toegang tot de systemen. Ook als een slachtoffer beveiligingsupdates van FortiGate installeert, blijft de toegang behouden.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
Examples include 'Drovorub ... initiated communication with C2 servers with an HTTP Upgrade request' and 'COATHANGER uses an HTTP GET request to initialize a follow-on TLS tunnel for command and control.' | The content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2.
"Anchor has used ICMP in C2 communications." / "COATHANGER uses ICMP for transmitting configuration information..." / "PHOREAL communicates via ICMP for C2." / "Regin ... can use ICMP to communicate between infected computers." / "Cobalt Strike can be configured to use TCP, ICMP, and UDP for C2 communications."
"a previously unknown malware strain named Coathanger, a remote access trojan (RAT) designed to infect Fortigate network security appliances"
Examples include: "COATHANGER uses an HTTP GET request to initialize a follow-on TLS tunnel for command and control" and "Drovorub can use the WebSocket protocol and has initiated communication with C2 servers with an HTTP Upgrade request."
The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.
Multiple malware families and intrusion sets are described as encrypting C2 traffic using SSL/TLS/HTTPS (e.g., "used HTTPS for command and control", "encrypts C2 communications with TLS", "uses SSL for encrypting C2 communications", "TLS-encrypted WebSocket Protocol (WSS) for C2").
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware implant/backdoor deployed after exploitation of a FortiGate vulnerability in a Chinese cyberespionage campaign. It was used to compromise Dutch Ministry of Defence networks and was later found on at least 20,000 FortiGate systems worldwide, with infections described as difficult to identify and remove.
Remote access trojan used to provide attackers with persistent remote control/access on compromised networks.
Custom remote access trojan (RAT) used to backdoor networks, providing persistent unauthorized access for threat actors.
Custom remote access trojan (RAT) used to backdoor networks, providing persistent remote access for threat actors.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.