Skip to content

S1105 COATHANGER

COATHANGER is a remote access tool (RAT) targeting FortiGate networking appliances. First used in 2023 in targeted intrusions against military and government entities in the Netherlands along with other victims, COATHANGER was disclosed in early 2024, with a high confidence assessment linking this malware to a state-sponsored entity in the People’s Republic of China. COATHANGER is delivered after gaining access to a FortiGate device, with in-the-wild observations linked to exploitation of CVE-2022-42475. The name COATHANGER is based on a unique string in the malware used to encrypt configuration files on disk: “She took his coat and hung it up”.1

Item Value
ID S1105
Associated Names
Type MALWARE
Version 1.1
Created 07 February 2024
Last Modified 15 April 2025
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
enterprise T1071 Application Layer Protocol -
enterprise T1071.001 Web Protocols COATHANGER uses an HTTP GET request to initialize a follow-on TLS tunnel for command and control.1
enterprise T1059 Command and Scripting Interpreter -
enterprise T1059.004 Unix Shell COATHANGER provides a BusyBox reverse shell for command and control.1
enterprise T1543 Create or Modify System Process -
enterprise T1543.004 Launch Daemon COATHANGER will create a daemon for timed check-ins with command and control infrastructure.1
enterprise T1140 Deobfuscate/Decode Files or Information COATHANGER decodes configuration items from a bundled file for command and control activity.1
enterprise T1573 Encrypted Channel -
enterprise T1573.002 Asymmetric Cryptography COATHANGER connects to command and control infrastructure using SSL.1
enterprise T1190 Exploit Public-Facing Application COATHANGER is installed following exploitation of a vulnerable FortiGate device. 1
enterprise T1083 File and Directory Discovery COATHANGER will survey the contents of system files during installation.1
enterprise T1222 File and Directory Permissions Modification -
enterprise T1222.002 Linux and Mac File and Directory Permissions Modification COATHANGER will set the GID of httpsd to 90 when infected.1
enterprise T1564 Hide Artifacts -
enterprise T1564.001 Hidden Files and Directories COATHANGER creates and installs itself to a hidden installation directory.1
enterprise T1574 Hijack Execution Flow COATHANGER will remove and write malicious shared objects associated with legitimate system functions such as read(2).1
enterprise T1574.006 Dynamic Linker Hijacking COATHANGER copies the malicious file /data2/.bd.key/preload.so to /lib/preload.so, then launches a child process that executes the malicious file /data2/.bd.key/authd as /bin/authd with the arguments /lib/preload.so reboot newreboot 1.1 This injects the malicious preload.so file into the process with PID 1, and replaces its reboot function with the malicious newreboot function for persistence.
enterprise T1070 Indicator Removal -
enterprise T1070.004 File Deletion COATHANGER removes files from victim environments following use in multiple instances.1
enterprise T1095 Non-Application Layer Protocol COATHANGER uses ICMP for transmitting configuration information to and from its command and control server.1
enterprise T1027 Obfuscated Files or Information COATHANGER can store obfuscated configuration information in the last 56 bytes of the file /date/.bd.key/preload.so.1
enterprise T1027.002 Software Packing The first stage of COATHANGER is delivered as a packed file.1
enterprise T1057 Process Discovery COATHANGER will query running process information to determine subsequent program execution flow.1
enterprise T1055 Process Injection COATHANGER includes a binary labeled authd that can inject a library into a running process and then hook an existing function within that process with a new function from that library.1
enterprise T1014 Rootkit COATHANGER hooks or replaces multiple legitimate processes and other functions on victim devices.1

References

  1. Dutch Military Intelligence and Security Service (MIVD) & Dutch General Intelligence and Security Service (AIVD). (2024, February 6). Ministry of Defense of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT. Retrieved February 7, 2024. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩