ATT&CK SoftwareCASTLETAP

CASTLETAP

S1224

Malware.View on attack.mitre.org

About this malware

CASTLETAP is an ICMP port knocking backdoor that has been installed on compromised FortiGate firewalls by UNC3886.

Techniques used8

Execution1

T1059.004Unix Shell

Persistence1

T1205.002Socket Filters

Stealth2

T1140Deobfuscate/Decode Files or Information T1205.002Socket Filters

Credential Access1

T1040Network Sniffing

Discovery1

T1040Network Sniffing

Collection1

T1005Data from Local System

Command and Control4

T1105Ingress Tool Transfer T1205.002Socket Filters T1573.001Symmetric Cryptography T1573.002Asymmetric Cryptography

Procedure examples8

Technique	Procedure example
T1005 Data from Local System	CASTLETAP can execute a C2 command to transfer files from victim machines. Mandiant Fortinet Zero Day
T1040 Network Sniffing	CASTLETAP has the ability to create a raw promiscuous socket to sniff network traffic. Mandiant Fortinet Zero Day
T1059.004 Unix Shell	CASTLETAP has the ability to spawn BusyBox command shell in victim environments. Mandiant Fortinet Zero Day
T1105 Ingress Tool Transfer	CASTLETAP can transfer files to compromised network devices. Mandiant Fortinet Zero Day
T1140 Deobfuscate/Decode Files or Information	CASTLETAP can filter and deobfuscate an XOR encrypted activation string in the payload of an ICMP echo request. Mandiant Fortinet Zero Day
T1205.002 Socket Filters	CASTLETAP can listen for a specialized ICMP packet for activation on compromised network devices. Mandiant Fortinet Zero Day
T1573.001 Symmetric Cryptography	CASTLETAP can receive a 9-byte XOR encrypted activation string in the payload of an ICMP echo request packet. Mandiant Fortinet Zero Day
T1573.002 Asymmetric Cryptography	CASTLETAP can initiate a C2 connection over an SSL socket. Mandiant Fortinet Zero Day

Groups that use it1

Campaigns0

None recorded.

References1

Mandiant Fortinet Zero Day Open source
Marvi, A. et al.. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved March 22, 2023.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.