ToddyCat

MITRE ATT&CK: G1022 View on attack.mitre.org

Aliases: Websiic, ToddyCat

First seen
2020-01-01 00:00:00
Primary motivation
espionage
Sophistication
advanced
Resource level
government
Actor type
nation-state
Profile updated
2026-07-07 11:48:30

Targeted industries: government-and-public-sector defense-and-aerospace

Targeted regions: country_code:ru country_code:cn country_code:fr country_code:de

Context

ToddyCat is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia.

Detection coverage

  • 144 YARA rules
  • 544 Sigma rules

Malware & tools used

  • Disable or Modify System Firewall (attack-pattern)
  • Data from Local System (attack-pattern)
  • Domain Groups (attack-pattern)
  • Scheduled Task (attack-pattern)
  • Spearphishing via Service (attack-pattern)
  • Domain Account (attack-pattern)
  • Non-Application Layer Protocol (attack-pattern)
  • Domain Accounts (attack-pattern)
  • Native API (attack-pattern)
  • Process Discovery (attack-pattern)
  • Remote System Discovery (attack-pattern)
  • System Network Connections Discovery (attack-pattern)
  • SMB/Windows Admin Shares (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Exploit Public-Facing Application (attack-pattern)
  • Exfiltration to Cloud Storage (attack-pattern)
  • Security Software Discovery (attack-pattern)
  • PowerShell (attack-pattern)
  • Hidden Window (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Remote Data Staging (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • Match Legitimate Resource Name or Location (attack-pattern)
  • Local Storage Discovery (attack-pattern)
  • Archive via Utility (attack-pattern)

Reports & references

  • ESET — Exchange Servers Under Siege 10 Apt Groups (report)
  • bleepingcomputer.com — New Toddycat Apt Group Targets Exchange Servers In Asia Europe (report)
  • Kaspersky — 106799 (report)
  • gteltsc.vn — Cap Nhat Nhe Ve Lo Hong Bao Mat 0Day Microsoft Exchange Dang Duoc Su Dung De Tan Cong Cac To Chuc Tai Viet Nam 9685 (report)
  • community.riskiq.com — D8B749F2 (report)
  • teamt5.org — Assassinations Of Minininja In Various Apac Countries (report)
  • raw.githubusercontent.com — Microsoftmapping (report)
  • MITRE ATT&CK — G1022 (report)
  • Kaspersky — 110696 (report)

External references