CASTLETAP — Malware Profile

CASTLETAP is an ICMP port knocking backdoor that has been installed on compromised FortiGate firewalls by UNC3886.

MITRE ATT&CK techniques (8)

• T1005 Data from Local System
• T1040 Network Sniffing
• T1059.004 Unix Shell
• T1105 Ingress Tool Transfer
• T1140 Deobfuscate/Decode Files or Information
• T1205.002 Socket Filters
• T1573.001 Symmetric Cryptography
• T1573.002 Asymmetric Cryptography

Attributed threat actors

• UNC3886

Read the full analysis on IntelFusions