Merge pull request #927 from Delta-Sierra/main

add COATHANGER RAT

clusters/rat.json

@@ -3634,7 +3634,19 @@
       },
       "uuid": "b30cb6f4-1e0a-4a97-8d88-ca38f83b4422",
       "value": "STRRAT"
+    },
+    {
+      "description": "Chinese FortiGate RAT. The COATHANGER malware is a remote access trojan (RAT) designed specifically for Fortigate appliances. It is used as second-stage malware, and does not exploit a new vulnerability. Intelligence services MIVD & AIVD refer to the malware as COATHANGER based on a string present in the code./nThe COATHANGER malware is stealthy and persistent. It hides itself by hooking system calls that could reveal its presence. It survives reboots and firmware upgrades./nMIVD & AIVD assess with high confidence that the malicious activity was conducted by a state-sponsored actor from the People’s Republic of China. This is part of a wider trend of Chinese political espionage against the Netherlands and its allies./nMIVD & AIVD assess that use of COATHANGER may be relatively targeted. The Chinese threat actor(s) scan for vulnerable edge devices at scale and gain access opportunistically, and likely introduce COATHANGER as a communication channel for select victims.",
+      "meta": {
+        "refs": [
+          "https://github.com/JSCU-NL/COATHANGER",
+          "https://www.ncsc.nl/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear",
+          "https://twitter.com/sehof/status/1754883344574103670"
+        ]
+      },
+      "uuid": "c04e9738-de62-43e4-b645-2e308c1f77f7",
+      "value": "COATHANGER"
     }
   ],
-  "version": 44
+  "version": 45
 }