ClickCease FortiGate Flaw: Threat Actors Breach Dutch Military Network

Content Table

Join Our Popular Newsletter

Join 4,500+ Linux & Open Source Professionals!

2x a month. No spam.

FortiGate Flaw: Threat Actors Breach Dutch Military Network

Wajahat Raja

February 19, 2024 - TuxCare expert team

In a recent revelation, the Dutch Ministry of Defence disclosed a concerning breach in its internal computer network, orchestrated by Chinese state-sponsored hackers. The network security breach, detected by both military (MIVD) and civilian (AIVD) security services, underscored the vulnerability posed by cyber threats to national security. The intrusion exploited a flaw in FortiGate devices – the FortiGate flaw, shedding light on the imperative of robust cybersecurity measures in safeguarding sensitive government networks.


FortiGate Flaw: Unveiling the Breach

Last year, a Chinese hacking group infiltrated the Dutch Ministry of Defence’s internal network, marking a significant breach in national security protocols. This breach, characterized by a cyber attack vector, targeted the ministry’s computer network, exploiting a vulnerability within FortiGate devices, as reported by Reuters.

The Scope of The FortiGate Flaw

The breach was identified within a segregated computer network utilized by the armed forces for unclassified research and development purposes. Fortunately, due to its compartmentalized nature, the intrusion did not extend to the broader Defence network, mitigating potential widespread damage.

Defense Minister Kajsa Ollongren emphasized the gravity of the breach, highlighting the necessity of attributing such cyber espionage activities to bolster international resilience against similar threats. The decision to publicly disclose technical details regarding the hackers’ methodologies signifies a proactive approach toward enhancing cybersecurity practices.

Vulnerability Exploitation

The hackers exploited a known vulnerability, CVE-2022-42475 with a CVSS score of
9.3, identified by Fortinet earlier, which allowed unauthorized access to government networks. Subsequently, a remote access trojan (RAT), dubbed COATHANGER, was deployed to conduct reconnaissance and extract user account information from the Active Directory server.

Understanding COATHANGER

The COATHANGER malware, aptly named for its unique encryption phrase, posed a significant threat to network integrity. Its utilization underscores the adaptability of cyber threats, capable of exploiting various software vulnerabilities beyond the initial breach.

Widespread Concerns

This incident follows a concerning trend of
cybersecurity vulnerabilities discovered in FortiGate devices, including the CVE-2023-27997, which raised alarms due to its prevalence among government organizations. The widespread usage of such products amplifies the potential impact of cyber intrusions, necessitating immediate remedial actions.

Assessing the Impact

The disclosure of
exploitable security flaws prompts reflection on the broader implications of cyber threats, particularly within critical infrastructure and government networks. The potential ramifications of unpatched vulnerabilities extend beyond national borders, warranting collaborative efforts to fortify cybersecurity defenses.

Continued Vigilance

Christopher Glyer of the Microsoft Threat Intelligence Center highlighted the persistent threat posed by cyber actors, urging continuous vigilance against potential exploits. While Fortinet refrained from directly attributing the breach to specific threat groups, the overarching warning emphasizes the need for proactive patching and mitigation strategies against
cyber defense weaknesses.

Mitigating Future Network Security Risks

Cyber threat intelligence
plays a crucial role in identifying and mitigating potential security risks in today’s digital landscape. Moving forward, proactive measures are essential to mitigate the risks associated with cyber threats. Enhanced collaboration between government entities, cybersecurity experts, and technology vendors is paramount in identifying and addressing vulnerabilities before they are exploited.


Dutch military network breach serves as a poignant reminder of the evolving threat landscape in cyberspace. By acknowledging vulnerabilities, adopting proactive security measures, and fostering international cooperation, governments can bolster their resilience against cyber intrusions, safeguarding national security and preserving public trust.


The sources for this piece include articles in The Hacker News and Bleeping Computer

FortiGate Flaw: Threat Actors Breach Dutch Military Network
Article Name
FortiGate Flaw: Threat Actors Breach Dutch Military Network
Discover how a Chinese hacker exploited the FortiGate flaw to breach the Dutch military network and learn the importance of cybersecurity.
Publisher Name
Publisher Logo

Looking to automate vulnerability patching without kernel reboots, system downtime, or scheduled maintenance windows?

Learn About Live Patching with TuxCare

Become a TuxCare Guest Writer

Get started




Linux & Open Source

Subscribe to
our newsletter