China Caught Dropping RAT Designed for FortiGate Devices

Dutch military intelligence (MIVD) disclosed that Chinese state-aligned actors used a persistent remote access Trojan dubbed "Coathanger" in 2023 to spy on the Dutch Ministry of Defense by leveraging a known FortiGate vulnerability (CVE-2022-42475); the malware is stealthy, survives reboots and firmware upgrades, and forms part of a broader campaign scanning and exploiting Internet-facing edge devices such as firewalls, VPNs and mail servers.