Loading malware…
COATHANGER is a custom remote access trojan targeting Fortinet FortiGate appliances running FortiOS. It has been associated with Chinese state-sponsored cyber-espionage activity and has been linked in public reporting to intrusions affecting the Dutch Ministry of Defence, as well as broader exploitation of vulnerable FortiGate devices worldwide. The malware is deployed after exploitation of FortiOS vulnerabilities, including CVE-2022-42475 and CVE-2023-27997, to establish covert access on edge network infrastructure.
The implant is designed for stealth and long-term persistence on compromised FortiGate systems. Reported behavior includes installation into a hidden directory, use of persistence mechanisms that allow it to survive reboots and even firmware upgrades by reinfecting itself during the reboot process, and interception or hooking of system functionality to conceal its presence. Components attributed to COATHANGER include an injector capable of loading a library into a running process and hooking existing functions, indicating process-injection and defense-evasion tradecraft tailored to FortiOS environments.
For command and control, COATHANGER has been observed using SSL-encrypted communications and ICMP-based exchanges for configuration data. It has also been reported to remove files from victim environments, consistent with anti-forensic cleanup. The first stage has been described as a packed file, suggesting additional efforts to hinder analysis and detection.
COATHANGER is best characterized as an espionage-oriented FortiGate RAT/backdoor used in highly targeted operations against government and other strategically significant organizations. Its focus on perimeter appliances, persistence across maintenance actions, and stealth on embedded security infrastructure make it notable among edge-device implants.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Agrius exploits public-facing applications for initial access to victim environments. Examples include widespread attempts to exploit CVE-2018-13379 in FortiOS devices... APT29 has exploited ... CVE-2018-13379 for FortiGate VPNs... Dragonfly ... exploited ... CVE-2018-13379 for Fortinet VPNs... Magic Hound ... exploited ... Fortios SSL VPNs (CVE-2018-13379). Play ... including CVE-2018-13379 ... in FortiOS.
Dutch authorities released a cybersecurity advisory about an attack against the Netherlands Ministry of Defence (MOD) in which attackers exploited CVE-2022-42475 against a Fortigate device to gain initial access and deploy malware known as "COATHANGER." ... The CSA notes ... exploitation of CVE-2022-42475 by Volt Typhoon against a vulnerable FortiGate 300D firewall that “was not patched.”
...the Chinese Volt Typhoon hacking group exploited two FortiOS vulnerabilities (tracked as CVE-2023-27997 and CVE-2022-42475) to deploy Coathanger remote access trojan malware...
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In February 2024, the service revealed that Chinese hackers had broken into a compartmentalized Dutch Ministry of Defence network by exploiting a FortiGate vulnerability, deploying malware the agencies named COATHANGER.
In February 2024, the service revealed that Chinese hackers had broken into a compartmentalized Dutch Ministry of Defence network by exploiting a FortiGate vulnerability, deploying malware the agencies named COATHANGER.
"...attackers exploited CVE-2022-42475 against a Fortigate device to gain initial access and deploy malware known as \"COATHANGER.\""
This sample contained an interesting string that led one of our CERT partners to name this cluster COATHANGER “She took his coat and hung it up.”
25 distinct techniques documented for this family, organized by ATT&CK tactic.
The report also sets out details about PLA hacking units that have not previously appeared in Western public intelligence reporting, stating that “multiple components within the same unit were even competing to find vulnerabilities in a particular type of edge device” in 2025.
Fortinet disclosed in February that the Chinese Volt Typhoon hacking group exploited two FortiOS SSL VPN flaws (CVE-2022-42475 and CVE-2023-27997) to backdoor a Dutch Ministry of Defence military network using custom Coathanger remote access trojan (RAT) malware.
Fortinet disclosed in February that the Chinese Volt Typhoon hacking group exploited two FortiOS SSL VPN flaws (CVE-2022-42475 and CVE-2023-27997) to backdoor a Dutch Ministry of Defence military network using custom Coathanger remote access trojan (RAT) malware.
The content repeatedly describes adversaries and malware injecting code, shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, wuauclt.exe, lsass.exe, and browser processes.
Silence has injected a DLL library containing a Trojan into the fwmain32.exe process. WarzoneRAT has the ability to inject malicious DLLs into a specific process for privilege escalation. COATHANGER includes a binary labeled authd that can inject a library into a running process and then hook an existing function within that process with a new function from that library.
The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.
The content repeatedly describes adversaries and malware injecting code, shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, wuauclt.exe, lsass.exe, and browser processes.
Silence has injected a DLL library containing a Trojan into the fwmain32.exe process. WarzoneRAT has the ability to inject malicious DLLs into a specific process for privilege escalation. COATHANGER includes a binary labeled authd that can inject a library into a running process and then hook an existing function within that process with a new function from that library.
Examples throughout the content include deleting tools, logs, malware-related files, staged archives, screenshots, temporary files, and exfiltrated data 'to cover their tracks,' 'reduce their footprint,' 'remove traces of activity,' or as part of 'post-intrusion cleanup.'
The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
Examples include 'Drovorub ... initiated communication with C2 servers with an HTTP Upgrade request' and 'COATHANGER uses an HTTP GET request to initialize a follow-on TLS tunnel for command and control.' | The content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2.
"Anchor has used ICMP in C2 communications." / "COATHANGER uses ICMP for transmitting configuration information..." / "PHOREAL communicates via ICMP for C2." / "Regin ... can use ICMP to communicate between infected computers." / "Cobalt Strike can be configured to use TCP, ICMP, and UDP for C2 communications."
"a previously unknown malware strain named Coathanger, a remote access trojan (RAT) designed to infect Fortigate network security appliances"
Examples include: "COATHANGER uses an HTTP GET request to initialize a follow-on TLS tunnel for command and control" and "Drovorub can use the WebSocket protocol and has initiated communication with C2 servers with an HTTP Upgrade request."
The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.
Multiple malware families and intrusion sets are described as encrypting C2 traffic using SSL/TLS/HTTPS (e.g., "used HTTPS for command and control", "encrypts C2 communications with TLS", "uses SSL for encrypting C2 communications", "TLS-encrypted WebSocket Protocol (WSS) for C2").
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware implant/backdoor deployed after exploitation of a FortiGate vulnerability in a Chinese cyberespionage campaign. It was used to compromise Dutch Ministry of Defence networks and was later found on at least 20,000 FortiGate systems worldwide, with infections described as difficult to identify and remove.
Remote access trojan used to provide attackers with persistent remote control/access on compromised networks.
Custom remote access trojan (RAT) used to backdoor networks, providing persistent unauthorized access for threat actors.
Custom remote access trojan (RAT) used to backdoor networks, providing persistent remote access for threat actors.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.