MITRE ATT&CKsoftware (malware)

S1224 CASTLETAP

Published 2025-06-16 Modified 2025-06-16 Official page ↗
Domain
enterprise
Platforms
Network Devices
Version
1.0
Created
2025-06-16

Description

CASTLETAP is an ICMP port knocking backdoor that has been installed on compromised FortiGate firewalls by UNC3886.

Related

Uses · MITRE ATT&CK (8)

  • T1205.002 Socket Filters sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1059.004 Unix Shell sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1005 Data from Local System technique
  • T1040 Network Sniffing technique
  • T1105 Ingress Tool Transfer technique

Referenced by MITRE ATT&CK · uses (1)

References