Log in Request a demo

Significant cyber incident

COATHANGER malware on a Dutch Defence network, published February 2024

COATHANGER is advanced Chinese malware that the MIVD and AIVD found on an isolated Dutch Ministry of Defence research network.

In short

COATHANGER is advanced Chinese malware that the MIVD and AIVD found on an isolated Dutch Ministry of Defence research network. It sat on FortiGate firewall devices and was built to keep access. The Dutch services published the finding on 6 February 2024 and attributed it to a Chinese state actor. A June 2024 follow-up said the campaign reached at least 20,000 FortiGate systems worldwide.

Last updated October 2026

What happened

The Dutch military intelligence service MIVD found advanced malware on part of the armed forces’ IT in 2023. It was on a separate network used for unclassified research and development. Because that network stood alone, the Dutch government says the Defense network itself was not damaged.

On 6 February 2024 the MIVD and the AIVD, with the National Cyber Security Centre (NCSC), published a report on the malware. It was a remote access trojan made only for FortiGate devices from Fortinet. The Dutch government said a Chinese state actor was responsible, based on MIVD intelligence. It was the first time the MIVD made a technical report on Chinese hackers’ methods public.

In June 2024 the NCSC and AIVD published more. Further MIVD research showed the campaign was much bigger than first known. The actor reached at least 20,000 FortiGate systems worldwide in 2022 and 2023, and knew of the flaw at least two months before Fortinet disclosed it.

Timeline

  1. December 2022

    The NCSC rates the FortiGate flaw CVE-2022-42475 as high probability and high impact.

  2. 2022 and 2023

    The state actor gains access to at least 20,000 FortiGate systems worldwide within a few months, using that flaw.

  3. At least two months before Fortinet's disclosure

    The actor already knows of the flaw; it infects 14,000 devices in this zero-day period.

  4. 2023

    The MIVD finds the malware on a separate armed forces network used for unclassified research and development.

  5. 6 February 2024

    The MIVD, AIVD and NCSC publish the report on the COATHANGER malware; the Dutch government names a Chinese state actor.

  6. 6 February 2024

    The NCSC publishes advice on edge devices and asks organizations that find the malware to report to it.

  7. June 2024

    The NCSC publishes a knowledge product on edge devices after further MIVD research shows a much larger campaign.

  8. 12 June 2024

    The AIVD repeats the warning on its own site.

  9. 7 October 2026

    The MIVD and AIVD issue a new cyber advisory warning of more Chinese attacks through edge devices.

How the attack worked

The sources opened are Dutch government statements. The detailed technical report was not retrievable as a page, so only what the government statements say is set out here.

Step 1: A known flaw in an internet-facing firewall

The NCSC says initial access could be gained by exploiting CVE-2022-42475 in FortiGate. The Dutch government stresses this is a known flaw, and that the publication does not describe a new weakness in all FortiGate devices. The NCSC says the actor knew of the flaw at least two months before Fortinet made it public. This matches the MITRE ATT&CK technique Exploit Public-Facing Application (T1190).

Step 2: A backdoor made for FortiGate

The MIVD and AIVD found a remote access trojan built specifically for FortiGate devices. The NCSC describes it as targeted, persistent malware that works outside the view of traditional detection. It is aimed at keeping access, not at getting it.

Step 3: Access that survives updates

The NCSC says the actor installed malware on relevant targets later, which gave permanent access. The actor kept access even after a victim installed FortiGate security updates. The NCSC adds that such infections are hard to find and remove, even with the technical report.

Why edge devices

The NCSC says edge devices are often not covered by endpoint detection and response tools, so unusual behavior is hard to see. Firewalls, VPN servers, routers and SMTP servers sit at the edge of the network, directly reachable from the internet.

How the attack ran
  1. Known flaw exploitedThe actor used CVE-2022-42475 in FortiGate, which it knew at least two months before Fortinet disclosed itTechnique T1190 (MITRE ATT&CK, opens in a new tab)
  2. Backdoor installedA remote access trojan built for FortiGate was placed on relevant targets
  3. Access keptThe malware keeps access even after security updates are installed
  4. Found and publishedThe MIVD found it on a separate Defense research network in 2023 and published the report on 6 February 2024

Who says who was behind it

Attributed by the MIVD to a Chinese state actor, 6 February 2024 (Dutch government news item, "on the basis of its own intelligence"). The sources opened name no specific group, so no threat group page is linked.

Impact

On the Dutch side: the malware was found on a separate armed forces network for unclassified research and development; the Dutch government says there was no damage to the Defense network because the system stood alone (6 February 2024).
Wider campaign, per the NCSC (June 2024): at least 20,000 FortiGate systems worldwide were accessed in 2022 and 2023, 14,000 of them infected in the zero-day period. Targets include dozens of Western governments, international organizations and many defense industry companies.
It is not known at how many victims malware was installed. The Dutch services and NCSC think it likely the actor could extend access at potentially hundreds of victims, and likely still has access at a significant number.

Government and regulator response

  • 6 February 2024: the MIVD, AIVD and NCSC published the report and the malware’s traits so FortiGate users can check whether they are victims. The MIVD asked organizations that find the malware to report to the NCSC.
  • 6 February 2024: the NCSC advised regular risk analysis of edge devices, not exposing management interfaces to the internet, regular log review, sending logs to a separate secure environment, fast security updates and replacing unsupported hardware and software.
  • June 2024: the NCSC published a knowledge product on edge devices, with its advisory, after further MIVD research.
  • 7 October 2026: the MIVD and AIVD issued a new cyber advisory on Chinese attacks through edge devices.

Lessons

  1. Edge devices need their own security plan

    The NCSC says firewalls and VPN servers are often not covered by endpoint detection tools, so odd behavior is hard to see. Do not assume they are watched.

  2. Patching is not enough

    The actor kept access after FortiGate updates were installed. After patching an exposed device, check whether it was already compromised.

  3. Know that zero-days come first

    The actor knew the flaw at least two months before disclosure and infected 14,000 devices in that time. Plan for compromise before the patch exists.

  4. Isolation limited the damage

    The Dutch government says the Defense network was not damaged because the affected system stood alone. Separating research networks pays off.

  5. Share indicators early

    The MIVD published the malware's traits so other users could check themselves. Report findings to the national CSIRT.

What to check in your own organization

  1. List every edge device

    Write down every firewall, VPN server, router and mail gateway facing the internet, with its software version and owner.

  2. Close management interfaces

    Check that no device management interface can be reached from the internet, as the NCSC advises.

  3. Review edge logs

    Look for logins at odd times, unknown foreign addresses and unapproved configuration changes, as the NCSC suggests.

  4. Store logs elsewhere

    Confirm firewall logs are sent to a separate secure place that an intruder on the device cannot edit.

  5. Update and retire

    Check that security updates reach edge devices fast and that unsupported hardware and software are replaced.

  6. Check for compromise, not only patches

    For devices that were exposed before a patch, ask for an integrity check or a rebuild, since a patch does not remove an existing backdoor.

  7. Know where to report

    Make sure staff know how to report suspected findings to the NCSC.

Questions

What was COATHANGER?

Malware found by the MIVD and AIVD on FortiGate devices. The NCSC describes it as a remote access trojan, targeted and persistent, made to keep access rather than to gain it.

Was the Dutch Defence network damaged?

No. The Dutch government says the malware was on a separate network for unclassified research and development, and that this isolation meant no damage to the Defense network.

Who was behind it?

The MIVD attributed it to a Chinese state actor, based on its own intelligence (6 February 2024). The sources opened do not name a specific group.

How many devices were affected worldwide?

The NCSC says the actor reached at least 20,000 FortiGate systems in 2022 and 2023. It is not known at how many victims malware was installed.

Was this a new flaw in FortiGate?

No. The Dutch government says the malware used a known vulnerability, and the publication describes no new flaw.

Sources

  1. MIVD onthult werkwijze Chinese spionage in Nederland (6 February 2024) Rijksoverheid (Ministry of Defence)
  2. Nieuwe malware benadrukt aanhoudende interesse in edge devices (6 February 2024) NCSC (Netherlands)
  3. Aanhoudende statelijke cyberspionagecampagne via kwetsbare edge devices (10 June 2024) NCSC (Netherlands)
  4. Aanhoudende statelijke cyberspionagecampagne via kwetsbare edge devices (12 June 2024) AIVD
  5. MIVD and AIVD warn of increase in Chinese cyber attacks through edge devices (7 October 2026) AIVD
  6. Exploit Public-Facing Application, T1190 MITRE ATT&CK
  7. External Remote Services, Technique T1133 - Enterprise MITRE ATT&CK

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Threat actor

A threat actor is an individual or a group that poses a threat to an organization or system.

Read more

Glossary term

Remote access trojan (RAT)

A remote access trojan, or RAT, is malware that lets an attacker control a computer from a distance.

Read more

Technique

External Remote Services

External Remote Services is a technique where an attacker uses a remote access service that faces the internet, such as a VPN or Citrix, to enter a network or to keep access to it.

Read more