MITRE ATT&CKsoftware (malware)
S1105 COATHANGER
- Domain
- enterprise
- Platforms
- Linux, Network Devices
- Version
- 1.1
- Created
- 2024-02-07
Description
COATHANGER is a remote access tool (RAT) targeting FortiGate networking appliances. First used in 2023 in targeted intrusions against military and government entities in the Netherlands along with other victims, COATHANGER was disclosed in early 2024, with a high confidence assessment linking this malware to a state-sponsored entity in the People's Republic of China. COATHANGER is delivered after gaining access to a FortiGate device, with in-the-wild observations linked to exploitation of CVE-2022-42475. The name COATHANGER is based on a unique string in the malware used to encrypt configuration files on disk: “She took his coat and hung it up”.
Related
Uses · MITRE ATT&CK (18)
- T1573.002 Asymmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1574.006 Dynamic Linker Hijacking sub-technique
- T1574 Hijack Execution Flow technique
- T1059.004 Unix Shell sub-technique
- T1564.001 Hidden Files and Directories sub-technique
- T1027.002 Software Packing sub-technique
- T1222.002 Linux and Mac Permissions sub-technique
- T1070.004 File Deletion sub-technique
- T1543.004 Launch Daemon sub-technique
- T1190 Exploit Public-Facing Application technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1014 Rootkit technique
- T1027 Obfuscated Files or Information technique
- T1055 Process Injection technique
- T1057 Process Discovery technique
- T1083 File and Directory Discovery technique
- T1095 Non-Application Layer Protocol technique