ToddyCat (G1022) | Threat Actor Index

About ToddyCat

ToddyCat is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia.

View MITRE record ↗

Techniques by Tactic (25)

Initial Access

T1078.002 Domain AccountsT1190 Exploit Public-Facing ApplicationT1566.003 Spearphishing via Service

Execution

T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1106 Native API

Persistence

T1053.005 Scheduled TaskT1078.002 Domain Accounts

Privilege Escalation

T1053.005 Scheduled TaskT1078.002 Domain Accounts

Stealth

T1036.005 Match Legitimate Resource Name or LocationT1078.002 Domain AccountsT1564.003 Hidden Window

Defence Impairment

T1686 Disable or Modify System Firewall

Discovery

T1018 Remote System DiscoveryT1049 System Network Connections DiscoveryT1057 Process DiscoveryT1069.002 Domain GroupsT1083 File and Directory DiscoveryT1087.002 Domain AccountT1518.001 Security Software DiscoveryT1680 Local Storage Discovery

Lateral Movement

T1021.002 SMB/Windows Admin Shares

Collection

T1005 Data from Local SystemT1074.002 Remote Data StagingT1560.001 Archive via Utility

Command & Control

T1095 Non-Application Layer Protocol

Exfiltration

T1567.002 Exfiltration to Cloud Storage

Toolsets (9)

🐛

China Chopper S0020

Malware · Windows

🐛

Cobalt Strike S0154

Malware · Linux, macOS, Windows

🐛

LoFiSe S1101

Malware · Windows

🐛

Ninja S1100

Malware · Windows

🐛

Pcexter S1102

Malware · Windows

🐛

Samurai S1099

Malware · Windows

🔧

Net S0039

Tool · Windows

🔧

Ping S0097

Tool

🔧

netstat S0104

Tool

CVEs Referenced (2 · 1 CISA KEV)

CVE-2014-7169View full details on NVDKEV

CVE-2016-6662View full details on NVD

References & Reports (2)