Malware

CASTLETAP

CASTLETAP is a malware implant documented in ATT&CK that can initiate command-and-control communications over an SSL socket and can create a raw promiscuous socket to sniff network traffic. The content links CASTLETAP to Chinese threat actor activity involving exploitation of security flaws in Fortinet appliances, alongside other implants such as BOLDMOVE and THINCRUST. High-confidence behavior described in the source includes SSL-encrypted C2 and packet-sniffing capability for network traffic collection. The available content does not provide additional confirmed details on specific infection workflow, persistence mechanisms, or victim sectors beyond its association with Fortinet appliance exploitation.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

"N-day security vulnerabilities in its software, such as CVE-2022-42475 and CVE-2023-27997, are being exploited by multiple activity clusters..." and "armed forces was infiltrated... by exploiting known flaws in Fortinet FortiGate devices to deliver a backdoor called COATHANGER."

Execution

1 technique

T1059.004Unix ShellEvidence1

Persistence

1 technique

T1205.002Socket FiltersEvidence1

Stealth

2 techniques

T1140Deobfuscate/Decode Files or InformationEvidence3

The content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'

T1205.002Socket FiltersEvidence1

Credential Access

1 technique

T1040Network SniffingEvidence2

Sandworm Team used BlackEnergy’s network sniffer module to discover user credentials being sent over the network...; APT33 has used SniffPass to collect credentials by sniffing network traffic; ArcaneDoor included network packet capture and sniffing...; multiple tools (CASTLETAP, Impacket, Empire, PoshC2, etc.) described as sniffing/packet capture.

Discovery

1 technique

T1040Network SniffingEvidence2

Collection

1 technique

T1005Data from Local SystemEvidence1

Command and Control

5 techniques

T1105Ingress Tool TransferEvidence1

T1205.002Socket FiltersEvidence1

T1573Encrypted ChannelEvidence1

The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.

T1573.001Symmetric CryptographyEvidence1

T1573.002Asymmetric CryptographyEvidence1

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Many entries state malware or actors can upload, transfer, send, or exfiltrate files from compromised hosts to command-and-control servers or attacker infrastructure.

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

mitre attack websiteNews

Oct 28, 2025

Updates | MITRE ATT&CK®

... CASTLETAP ... (v1.0) ...

mitre attack websiteNews

Oct 28, 2025

Updates - Updates - October 2025 | MITRE ATT&CK®

CASTLETAP (v1.0)

the hacker newsNews

Feb 9, 2024

Fortinet Warns of Critical FortiOS SSL VPN Flaw Likely Under Active Exploitation

Implant/backdoor associated with Chinese threat actors, delivered via exploitation of Fortinet appliance vulnerabilities (including zero-days) to establish access on targeted devices.

mitre attack websiteNews

Mar 8, 2018

Network Sniffing, Technique T1040 - Enterprise | MITRE ATT&CK®

Malware with capability to sniff network traffic via raw promiscuous sockets.

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

CASTLETAP