Chinese hackers breached 20,000 FortiGate systems worldwide

The Dutch MIVD disclosed that a Chinese state-sponsored group exploited a FortiGate RCE (CVE-2022-42475) as a zero-day in 2022–2023 to deploy the persistent Coathanger RAT, compromising an estimated 14,000–20,000 devices worldwide and targeting Western governments, international organizations and defense industry entities; the implant can survive reboots and firmware upgrades, allowing sustained access even after patches are applied.