ToddyCat — Threat Actors — SecurityStudies.info

Profile

Also known as: Websiic

ToddyCat is responsible for multiple sets of attacks detected since December 2020 against high-profile entities in Europe and Asia. There is still little information about this actor, but its main distinctive signs are two formerly unknown tools that Kaspersky call ‘Samurai backdoor’ and ‘Ninja Trojan’.

ATT&CK techniques · 25

Initial Access

T1078.002Domain Accounts T1190Exploit Public-Facing Application T1566.003Spearphishing via Service

Execution

T1047Windows Management Instrumentation T1053.005Scheduled Task T1059.001PowerShell T1059.003Windows Command Shell T1106Native API

Stealth

T1036.005Match Legitimate Resource Name or Location T1564.003Hidden Window

Defense Impairment

T1686Disable or Modify System Firewall

Discovery

T1018Remote System Discovery T1049System Network Connections Discovery T1057Process Discovery T1069.002Domain Groups T1083File and Directory Discovery T1087.002Domain Account T1518.001Security Software Discovery T1680Local Storage Discovery

Lateral Movement

T1021.002SMB/Windows Admin Shares

Collection

T1005Data from Local System T1074.002Remote Data Staging T1560.001Archive via Utility

Command and Control

T1095Non-Application Layer Protocol

Exfiltration

T1567.002Exfiltration to Cloud Storage

Incidents attributed

No incident in the register is attributed to this actor.

In the news

No Asia-Pacific article names this actor yet.

csrftoken	CSRF protection — prevents cross-site request forgery attacks	1 year	Essential
sessionid	Session management — keeps authenticated users logged in	14 days	Essential