COATHANGER

Executive Summary

COATHANGER is a state‑sponsored RAT that targets FortiGate appliances via CVE‑2022‑42475, enabling persistent remote access and data exfiltration. It encrypts its configuration files on disk using a hard‑coded phrase, evading standard detection tools. Prompt patching, network segmentation, and intrusion visibility are essential to mitigate this threat.

COATHANGER is a sophisticated remote access trojan (RAT) engineered to compromise Cisco‑derived FortiGate network appliances, with a specific focus on high‑profile military and government infrastructures. First documented in 2023 during targeted intrusions against Dutch state agencies, the tool was later disclosed by the Dutch National Cyber Security Centre in February 2024. The exploitation chain typically begins with an attacker exploiting CVE‑2022‑42475—a remote code execution vulnerability that permits arbitrary command execution on FortiGate firmware versions released prior to the vendor’s patch. Once access is established, COATHANGER installs a persistent backdoor by modifying system configuration files and encrypting them using a hard‑coded phrase (“She took his coat and hung it up”), effectively obfuscating its presence from ordinary file‑system scans. After achieving persistence, the malware establishes outbound telemetry to command‐and‐control (C2) endpoints. COATHANGER then performs lateral movement within the device’s operational environment by leveraging privileged APIs such as the FortiOS CLI or REST interface, allowing it to execute arbitrary shell commands, enumerate system information, and exfiltrate credentials or configuration data. The tool is tailored for stealth; its encrypted configuration files trigger minimal alerts in standard intrusion detection systems, while network traffic may piggyback on legitimate HTTPS/SSH channels, making it difficult to isolate without deep packet inspection. The threat intelligence community has attributed COATHANGER to a state‑sponsored actor based in the People’s Republic of China. The attribution is supported by code similarities with other Chinese APT families, the timing of the attacks against Dutch military targets, and the use of a known vulnerability that the country was reported to have actively leveraged in prior operations. The impact of this RAT is significant: compromised FortiGate appliances can provide adversaries with network‑wide visibility, manipulation of traffic filtering rules, and covert exfiltration paths back into enterprise networks. Security teams should treat COATHANGER as a high‑severity threat that requires immediate remediation through patching, device isolation, and rigorous monitoring for abnormal configuration changes or outbound connections to undocumented IP addresses.

Key Capabilities

• Remote code execution via CVE-2022-42475
• Persistent backdoor installation through encrypted config files
• Command-and-control traffic over legitimate HTTPS/SSH channels
• Remote shell and CLI command execution
• Credential and configuration exfiltration
• Lateral movement using FortiOS APIs

ATT&CK Techniques

Recommended Actions

• Apply the latest firmware patches to all FortiGate devices, especially those addressing CVE-2022-42475.
• Isolate affected appliances from production networks until a full forensic review is completed.
• Deploy IDS/IPS rules that flag unknown outbound HTTPS and SSH traffic originating from FortiGate units.
• Implement strict network segmentation to limit lateral movement opportunities.
• Enable and monitor FortiOS logging for anomalous API calls, configuration changes, or privilege escalations.
• Perform regular integrity checks on critical files such as /var/lib/FortiOS/* to detect tampering.
• Block known C2 IP addresses identified in threat feeds, and enforce whitelisting of authorized management servers.

Suggested Tags