H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[CASTLETAP](https://attack.mitre.org/software/S1224) is an ICMP port knocking backdoor that has been installed on compromised FortiGate firewalls by [UNC3886](https://attack.mitre.org/groups/G1048).(Citation: Mandiant Fortinet Zero Day)

Labels

malware

9 recorded

Relationships

uses

to Asymmetric Cryptography

Technique

uses

to Data from Local System

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Network Sniffing

Technique

uses

to Socket Filters

Technique

uses

to Symmetric Cryptography

Technique

uses

to Unix Shell

Technique

uses

from UNC3886

Group

2 external

References

mitre-attack

S1224

open

Mandiant Fortinet Zero Day

https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem

open