COATHANGER

MITRE ATT&CK: S1105 View on attack.mitre.org

Aliases: COATHANGER

First seen
2023-01-01 00:00:00
Malware type
rat
Family
Malware family
Operating systems
linux, network-devices
Profile updated
2026-07-07 14:22:43

Targeted industries: government-and-public-sector defense-and-aerospace

Targeted regions: country_code:nl

Context

COATHANGER is a remote access tool (RAT) targeting FortiGate networking appliances. First used in 2023 in targeted intrusions against military and government entities in the Netherlands along with other victims, COATHANGER was disclosed in early 2024, with a high confidence assessment linking this malware to a state-sponsored entity in the People's Republic of China. COATHANGER is delivered after gaining access to a FortiGate device, with in-the-wild observations linked to exploitation of CVE-2022-42475. The name COATHANGER is based on a unique string in the malware used to encrypt configuration files on disk: “She took his coat and hung it up”.

Detection coverage

  • 2 YARA rules
  • 284 Sigma rules

Malware & tools used

  • File Deletion (attack-pattern)
  • Non-Application Layer Protocol (attack-pattern)
  • Process Discovery (attack-pattern)
  • Launch Daemon (attack-pattern)
  • Process Injection (attack-pattern)
  • Unix Shell (attack-pattern)
  • Exploit Public-Facing Application (attack-pattern)
  • Linux and Mac Permissions (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Rootkit (attack-pattern)
  • Dynamic Linker Hijacking (attack-pattern)
  • Software Packing (attack-pattern)
  • Asymmetric Cryptography (attack-pattern)
  • Hijack Execution Flow (attack-pattern)
  • Web Protocols (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Hidden Files and Directories (attack-pattern)
  • Obfuscated Files or Information (attack-pattern)

Exploited vulnerabilities

  • CVE-2022-42475 (vulnerability)

Detection rules

  • SEKOIA_Apt_Coathanger_Files (yara-rule)
  • SEKOIA_Apt_Coathanger_Beacon (yara-rule)

Reports & references

  • ncsc.nl — Tlp Clear+Mivd+Aivd+Advisory+Coathanger (report)
  • MITRE ATT&CK — S1105 (report)
  • github.com — Coathanger (report)
  • ncsc.nl — Mivd Aivd Advisory Coathanger Tlp Clear (report)
  • twitter.com — 1754883344574103670 (report)

External references