Malware Analysis Report: UMBRELLA STAND - Malware targeting Fortinet devices
UMBRELLA STAND is a sophisticated malware targeting FortiGate 100D series firewalls produced by Fortinet. It contains remote shell execution functionality, configurable beacon frequency, and AES-encrypted C2 communications. The malware uses fake TLS on port 443 to beacon to its C2 server and has the ability to run shell commands. It employs various defense evasion techniques such as hidden folders, generic filenames, and string encryption. UMBRELLA STAND also has persistence mechanisms through reboot hooking and ldpreload. Associated tooling includes BusyBox, nbtscan, tcpdump, and openLDAP. The malware demonstrates operational security considerations and shares similarities with previously reported COATHANGER malware.
Pulse ID: 68593bc9c284f1baf4623782
Pulse Link: https://otx.alienvault.com/pulse/68593bc9c284f1baf4623782
Pulse Author: AlienVault
Created: 2025-06-23 11:34:33
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#CyberSecurity #Encryption #InfoSec #Malware #OTX #OpenThreatExchange #RAT #SMS #TCP #TLS #bot #AlienVault
