CASTLETAP

Executive Summary

CASTLETAP exploits FortiGate firewalls by listening for an ICMP port‑knocking sequence that opens a covert channel for remote command execution. The backdoor hides within legitimate ICMP traffic, making it difficult to detect with standard firewall inspection tools. Attackers can gain full CLI access and exfiltrate sensitive configuration data.

CASTLETAP is an ICMP‑based port‑knocking backdoor designed for use against FortiGate firewalls running on network device platforms. The code listens for a predefined sequence of IPv4 or IPv6 ICMP echo requests; when the exact pattern is detected it triggers the creation of a covert tunnel that allows the attacker to execute arbitrary commands, transfer files, and exfiltrate data from inside the protected network. The backdoor leverages FortiGate’s privileged CLI interface as its attack surface. Once activated, CASTLETAP can remotely invoke shell commands, modify firewall policy tables, and establish a persistent connection that resists detection by conventional port‑based monitors because it operates over standard ICMP traffic, which is often allowed through firewalls without deep packet inspection. The malware’s installation is attributed to the supply‑chain actor UNC3886, with evidence pointing to the exploitation of a zero‑day vulnerability disclosed by Mandiant in its Fortinet investigation. Operationally, CASTLETAP remains dormant until the ICMP knock pattern arrives from an attacker‑controlled IP address. After activation, it opens a backchannel that can be used for lateral movement within the device’s operating system and to exfiltrate logs or configuration information. The stealthy nature of its traffic combined with the privileged privileges grants attackers broad control over network infrastructure, posing a substantial risk to critical communications. Because the tool was first observed in enterprise deployments of FortiGate firewalls, organizations using Fortinet products should scrutinize ICMP traffic for anomalous or repeated echo requests, especially from untrusted sources. Regular firmware updates and hardening of privileged access are essential mitigations.

Key Capabilities

• Listens for a specific ICMP echo request pattern (port‑knocking)
• Creates a covert tunnel over standard ICMP traffic
• Executes arbitrary shell commands on the FortiGate device
• Modifies firewall policy tables and configuration files
• Exfiltrates logs and critical configuration data

ATT&CK Techniques

Recommended Actions

• Ensure all FortiGate units are updated to the latest firmware version that addresses known vulnerabilities
• Restrict inbound ICMP echo requests to trusted IP ranges using ACLs or VPN policies
• Enable logging of all ICMP traffic and monitor for repeated, patterned echo requests
• Apply least‑privilege controls on administrative accounts and disable unused CLI services
• Deploy network intrusion detection/prevention systems with signatures matching CASTLETAP ICMP patterns
• Conduct regular security audits of firewall configurations and access privileges

Suggested Tags