H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

COATHANGER

[COATHANGER](https://attack.mitre.org/software/S1105) is a remote access tool (RAT) targeting FortiGate networking appliances. First used in 2023 in targeted intrusions against military and government entities in the Netherlands along with other victims, [COATHANGER](https://attack.mitre.org/software/S1105) was disclosed in early 2024, with a high confidence assessment linking this malware to a state-sponsored entity in the People's Republic of China. [COATHANGER](https://attack.mitre.org/software/S1105) is delivered after gaining access to a FortiGate device, with in-the-wild observations linked to exploitation of CVE-2022-42475. The name [COATHANGER](https://attack.mitre.org/software/S1105) is based on a unique string in the malware used to encrypt configuration files on disk: “She took his coat and hung it up” .(Citation: NCSC-NL COATHANGER Feb 2024)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[COATHANGER](https://attack.mitre.org/software/S1105) is a remote access tool (RAT) targeting FortiGate networking appliances. First used in 2023 in targeted intrusions against military and government entities in the Netherlands along with other victims, [COATHANGER](https://attack.mitre.org/software/S1105) was disclosed in early 2024, with a high confidence assessment linking this malware to a state-sponsored entity in the People's Republic of China. [COATHANGER](https://attack.mitre.org/software/S1105) is delivered after gaining access to a FortiGate device, with in-the-wild observations linked to exploitation of CVE-2022-42475. The name [COATHANGER](https://attack.mitre.org/software/S1105) is based on a unique string in the malware used to encrypt configuration files on disk: “She took his coat and hung it up” .(Citation: NCSC-NL COATHANGER Feb 2024)

Labels

malware
18 recorded

Relationships

uses
to Asymmetric Cryptography
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Dynamic Linker Hijacking
Technique
uses
to Exploit Public-Facing Application
Technique
uses
to File and Directory Discovery
Technique
uses
to File Deletion
Technique
uses
to Hidden Files and Directories
Technique
uses
to Hijack Execution Flow
Technique
uses
to Launch Daemon
Technique
uses
to Linux and Mac Permissions
Technique
uses
to Non-Application Layer Protocol
Technique
uses
to Obfuscated Files or Information
Technique
uses
to Process Discovery
Technique
uses
to Process Injection
Technique
uses
to Rootkit
Technique
uses
to Software Packing
Technique
uses
to Unix Shell
Technique
uses
to Web Protocols
Technique
2 external

References

mitre-attack
S1105
open
NCSC-NL COATHANGER Feb 2024
https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear/TLP-CLEAR+MIVD+AIVD+Advisory+COATHANGER.pdf
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance