Loading malware…
COATHANGER is a previously unknown remote access trojan (RAT) designed to infect FortiGate network security appliances running FortiOS. It has been observed installed after exploitation of vulnerable FortiGate devices, including exploitation of CVE-2022-42475 and, in later reporting, CVE-2023-27997. Dutch intelligence services reported that Chinese state-sponsored actors used COATHANGER to breach a compartmentalized Dutch Ministry of Defence network in 2023, and subsequent reporting linked the activity to Volt Typhoon; Fortinet also assessed a limited-sighting COATHANGER-related cluster as possibly a different APT with hallmarks similar to APT15. The malware is associated with cyber-espionage activity and Fortinet reported the broader campaign affected government, service providers, consultancies, manufacturing, and critical infrastructure organizations, with at least 20,000 FortiGate systems reportedly infected worldwide in the same campaign.
Capabilities and behavior directly described in the content include installation into a hidden directory, SSL-encrypted command-and-control communications, and use of ICMP to transmit configuration information to and from its C2 server. Its first stage is delivered as a packed file. COATHANGER includes a binary labeled authd that can inject a library into a running process and hook an existing function within that process with a new function from that library. The malware is described as highly persistent: it can recover after reboot by injecting a backup of itself into the process responsible for rebooting the system, and infections can survive firmware upgrades by reinfecting during reboot. It also hides itself by intercepting system calls, and reporting notes that COATHANGER-related infections are difficult to identify and remove. The malware has also been reported to remove files from victim environments following use.
Cluster-specific components attributed to COATHANGER in Fortinet reporting include libpe.so (an unpacker), smartctl (a trojanized command executor), authd (process injection with API hooking), httpsd (C2 and configuration read/write), newcli (injector), preload.so (persistence via reboot-hooking), liblog.so (log-related hooking), and a container packfile.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Agrius exploits public-facing applications for initial access to victim environments. Examples include widespread attempts to exploit CVE-2018-13379 in FortiOS devices... APT29 has exploited ... CVE-2018-13379 for FortiGate VPNs... Dragonfly ... exploited ... CVE-2018-13379 for Fortinet VPNs... Magic Hound ... exploited ... Fortios SSL VPNs (CVE-2018-13379). Play ... including CVE-2018-13379 ... in FortiOS.
Dutch authorities released a cybersecurity advisory about an attack against the Netherlands Ministry of Defence (MOD) in which attackers exploited CVE-2022-42475 against a Fortigate device to gain initial access and deploy malware known as "COATHANGER." ... The CSA notes ... exploitation of CVE-2022-42475 by Volt Typhoon against a vulnerable FortiGate 300D firewall that “was not patched.”
...the Chinese Volt Typhoon hacking group exploited two FortiOS vulnerabilities (tracked as CVE-2023-27997 and CVE-2022-42475) to deploy Coathanger remote access trojan malware...
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In February 2024, the service revealed that Chinese hackers had broken into a compartmentalized Dutch Ministry of Defence network by exploiting a FortiGate vulnerability, deploying malware the agencies named COATHANGER.
In February 2024, the service revealed that Chinese hackers had broken into a compartmentalized Dutch Ministry of Defence network by exploiting a FortiGate vulnerability, deploying malware the agencies named COATHANGER.
"...attackers exploited CVE-2022-42475 against a Fortigate device to gain initial access and deploy malware known as \"COATHANGER.\""
This sample contained an interesting string that led one of our CERT partners to name this cluster COATHANGER “She took his coat and hung it up.”
25 distinct techniques documented for this family, organized by ATT&CK tactic.
The report also sets out details about PLA hacking units that have not previously appeared in Western public intelligence reporting, stating that “multiple components within the same unit were even competing to find vulnerabilities in a particular type of edge device” in 2025.
Fortinet disclosed in February that the Chinese Volt Typhoon hacking group exploited two FortiOS SSL VPN flaws (CVE-2022-42475 and CVE-2023-27997) to backdoor a Dutch Ministry of Defence military network using custom Coathanger remote access trojan (RAT) malware.
Fortinet disclosed in February that the Chinese Volt Typhoon hacking group exploited two FortiOS SSL VPN flaws (CVE-2022-42475 and CVE-2023-27997) to backdoor a Dutch Ministry of Defence military network using custom Coathanger remote access trojan (RAT) malware.
The content repeatedly describes adversaries and malware injecting code, shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, wuauclt.exe, lsass.exe, and browser processes.
Silence has injected a DLL library containing a Trojan into the fwmain32.exe process. WarzoneRAT has the ability to inject malicious DLLs into a specific process for privilege escalation. COATHANGER includes a binary labeled authd that can inject a library into a running process and then hook an existing function within that process with a new function from that library.
The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.
The content repeatedly describes adversaries and malware injecting code, shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, wuauclt.exe, lsass.exe, and browser processes.
Silence has injected a DLL library containing a Trojan into the fwmain32.exe process. WarzoneRAT has the ability to inject malicious DLLs into a specific process for privilege escalation. COATHANGER includes a binary labeled authd that can inject a library into a running process and then hook an existing function within that process with a new function from that library.
Examples throughout the content include deleting tools, logs, malware-related files, staged archives, screenshots, temporary files, and exfiltrated data 'to cover their tracks,' 'reduce their footprint,' 'remove traces of activity,' or as part of 'post-intrusion cleanup.'
The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
Agent Tesla has created hidden folders. AppleJeus has added a leading . to plist filenames, unlisting them from the Finder app and default Terminal directory listings. APT28 has saved files with hidden file attributes. FIN13 has created hidden files and folders within a compromised Linux system /tmp directory and also used attrib.exe to hide gathered local host information.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
Examples include 'Drovorub ... initiated communication with C2 servers with an HTTP Upgrade request' and 'COATHANGER uses an HTTP GET request to initialize a follow-on TLS tunnel for command and control.' | The content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2.
"Anchor has used ICMP in C2 communications." / "COATHANGER uses ICMP for transmitting configuration information..." / "PHOREAL communicates via ICMP for C2." / "Regin ... can use ICMP to communicate between infected computers." / "Cobalt Strike can be configured to use TCP, ICMP, and UDP for C2 communications."
"a previously unknown malware strain named Coathanger, a remote access trojan (RAT) designed to infect Fortigate network security appliances"
Examples include: "COATHANGER uses an HTTP GET request to initialize a follow-on TLS tunnel for command and control" and "Drovorub can use the WebSocket protocol and has initiated communication with C2 servers with an HTTP Upgrade request."
The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.
Multiple malware families and intrusion sets are described as encrypting C2 traffic using SSL/TLS/HTTPS (e.g., "used HTTPS for command and control", "encrypts C2 communications with TLS", "uses SSL for encrypting C2 communications", "TLS-encrypted WebSocket Protocol (WSS) for C2").
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware implant/backdoor deployed after exploitation of a FortiGate vulnerability in a Chinese cyberespionage campaign. It was used to compromise Dutch Ministry of Defence networks and was later found on at least 20,000 FortiGate systems worldwide, with infections described as difficult to identify and remove.
Remote access trojan used to provide attackers with persistent remote control/access on compromised networks.
Custom remote access trojan (RAT) used to backdoor networks, providing persistent unauthorized access for threat actors.
Custom remote access trojan (RAT) used to backdoor networks, providing persistent remote access for threat actors.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.