CASTLETAP

Malware & Tools · CASTLETAP

· MalwareS1224 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Network Devices

Description

CASTLETAP is an ICMP port knocking backdoor that has been installed on compromised FortiGate firewalls by UNC3886.(Citation: Mandiant Fortinet Zero Day)

Tactic Coverage

command and control (4)stealth (2)collection (1)credential access (1)discovery (1)execution (1)persistence (1)

Used By (1 groups)

G1048UNC3886

Techniques (8)

T1005Data from Local System

collection

T1040Network Sniffing

credential accessdiscovery

T1059.004Unix Shell

execution

T1105Ingress Tool Transfer

command and control

T1140Deobfuscate/Decode Files or Information

stealth

T1205.002Socket Filters

stealthpersistence

References

https://attack.mitre.org/software/S1224 https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem