ToddyCat

· ATT&CK GroupG1022

Techniques

Software

Tactics

Aliases

Description

ToddyCat is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kaspersky ToddyCat Check Logs October 2023)

Tactic Coverage

discovery (8)execution (5)collection (3)stealth (3)initial access (3)persistence (2)privilege escalation (2)lateral movement (1)command and control (1)exfiltration (1)defense impairment (1)

Techniques Used (25)

T1005Data from Local System

collection

T1018Remote System Discovery

discovery

T1021.002SMB/Windows Admin Shares

lateral movement

T1036.005Match Legitimate Resource Name or Location

stealth

T1047Windows Management Instrumentation

execution

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 25 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (9)

S0020China Choppermalware S0154Cobalt Strikemalware S1101LoFiSemalware S0039Nettool S1100Ninjamalware S1102Pcextermalware S0097Pingtool S1099Samurai

References (3)

https://attack.mitre.org/groups/G1022 https://securelist.com/toddycat/106799/https://securelist.com/toddycat-keep-calm-and-check-logs/110696/