Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

SHOE RACK is a sophisticated malware developed in Go 1.18, designed for post-exploitation activities. It connects to a custom SSH server at a hardcoded C2 URL, enabling remote interaction with the victim device. The malware utilizes DNS-over-HTTPS to locate its C2 server's IP address and has been observed targeting FortiGate 100D series firewalls. SHOE RACK supports various channel types, including 'session' and a non-standard 'jump' type, allowing for reverse-SSH tunneling. It also offers TCP tunneling capabilities, enabling actors to pivot into LAN networks after compromising perimeter devices. While some operational security measures are implemented, the malware's network communications are distinctive due to its impersonation of an outdated SSH version.

SHOE RACK is a sophisticated post-exploitation malware tool developed using Go 1.18, designed primarily to facilitate remote shell access and TCP tunneling through compromised victim devices. The malware specifically targets FortiGate 100D series firewalls, which are widely used perimeter security devices. Upon infection, SHOE RACK connects to a hardcoded command-and-control (C2) server via a custom SSH server URL. To evade detection and improve resilience, it uses DNS-over-HTTPS (DoH) to resolve the IP address of its C2 server, thereby bypassing traditional DNS monitoring and filtering mechanisms. The malware supports multiple channel types, including a standard 'session' channel and a non-standard 'jump' channel that enables reverse-SSH tunneling. This capability allows threat actors to pivot from the compromised firewall into internal LAN networks, effectively bypassing perimeter defenses and expanding their foothold within the victim environment. Additionally, SHOE RACK offers TCP tunneling features, which further facilitate lateral movement and data exfiltration. While the malware implements some operational security measures to avoid detection, its network communications are distinguishable due to its impersonation of an outdated SSH version string, which can be used as a detection signature. Indicators of compromise include multiple file hashes and a domain (phcia.duckdns.org) associated with the C2 infrastructure. Although no known exploits are currently reported in the wild, the targeting of critical network infrastructure like FortiGate firewalls and the advanced tunneling capabilities make SHOE RACK a significant threat in post-exploitation scenarios.

Detailed information about SHOE RACK: A post-exploitation tool for remote shell access & TCP tunnelling through a victim device. Get real-time updates, technica

SHOE RACK: A post-exploitation tool for remote shell access & TCP tunnelling through a victim device - Live Threat Intelligence - Threat Radar | OffSeq.com

SHOE RACK: A post-exploitation tool for remote shell access & TCP tunnelling through a victim device

UMBRELLA STAND is a sophisticated malware targeting FortiGate 100D series firewalls produced by Fortinet. It contains remote shell execution functionality, configurable beacon frequency, and AES-encrypted C2 communications. The malware uses fake TLS on port 443 to beacon to its C2 server and has the ability to run shell commands. It employs various defense evasion techniques such as hidden folders, generic filenames, and string encryption. UMBRELLA STAND also has persistence mechanisms through reboot hooking and ldpreload. Associated tooling includes BusyBox, nbtscan, tcpdump, and openLDAP. The malware demonstrates operational security considerations and shares similarities with previously reported COATHANGER malware.

UMBRELLA STAND is a sophisticated malware strain specifically targeting Fortinet FortiGate 100D series firewalls. This malware is designed to compromise network perimeter security devices, enabling attackers to gain remote shell access to the affected firewall. It features configurable beaconing intervals to communicate with its command and control (C2) servers over port 443 using fake TLS traffic, which helps it blend in with legitimate encrypted traffic and evade network detection. The C2 communications are encrypted using AES, adding a layer of confidentiality to the attacker’s command channel. UMBRELLA STAND employs multiple defense evasion techniques, including the use of hidden folders and generic filenames to avoid detection by administrators and security tools, as well as string encryption to hinder static analysis. For persistence, it hooks into the system reboot process and uses the ldpreload mechanism to maintain its presence even after device restarts. The malware also leverages legitimate tools such as BusyBox, nbtscan, tcpdump, and openLDAP to facilitate network reconnaissance and data exfiltration, indicating a high level of operational security and sophistication. The malware shares similarities with the previously documented COATHANGER malware, suggesting possible shared development lineage or adversary tactics. Notably, there are no known exploits in the wild targeting this malware yet, and no specific affected firmware versions have been identified, which may indicate either a targeted or emerging threat. The malware’s ability to execute arbitrary shell commands remotely on a firewall device poses a significant risk to network integrity and confidentiality.

Detailed information about Malware Analysis Report: UMBRELLA STAND - Malware targeting Fortinet devices. Get real-time updates, technical details, and mitigatio

Title	Severity	Type	Source	Date

Threats Tagged 'remote shell'

Filter Threats

Threats Tagged 'remote shell'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility