ToddyCat
ToddyCat is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia.
- ATT&CK ID
- G1022
- Techniques
- 24
- Tools
- 9
Vulnerabilities it has exploited
Techniques
Initial Access
Valid AccountsExploit Public-Facing ApplicationPhishing
Execution
Windows Management InstrumentationScheduled Task/JobCommand and Scripting InterpreterNative API
Persistence
Scheduled Task/JobValid Accounts
Privilege Escalation
Scheduled Task/JobValid Accounts
Stealth
MasqueradingValid AccountsHide Artifacts
Defense Impairment
Disable or Modify System Firewall
Discovery
Remote System DiscoverySystem Network Connections DiscoveryProcess DiscoveryPermission Groups DiscoveryFile and Directory DiscoveryAccount DiscoverySoftware DiscoveryLocal Storage Discovery
Lateral Movement
Collection
Data from Local SystemData StagedArchive Collected Data
Command and Control
Non-Application Layer Protocol
Exfiltration
Software
China Chopper · Cobalt Strike · LoFiSe · Net · Ninja · Pcexter · Ping · Samurai · netstat