ToddyCat is a threat actor of unknown origin targeting military and government sectors since December 2020.
ToddyCat (also tracked as Websiic) is a threat actor of unknown origin active since December 2020. It primarily targets military and government sectors across multiple countries in Europe and Asia. The actor uses 'Exploit Public-Facing Application' and 'Spearphishing via Service' for initial access, followed by 'Scheduled Task' for execution, and leverages 'SMB/Windows Admin Shares' for lateral movement, ultimately exfiltrating data to cloud storage. Defenders should focus on detecting 'Cobalt Strike', the custom 'Samurai backdoor' and 'Ninja Trojan', along with patching public-facing applications and closely monitoring domain account usage.
ToddyCat is responsible for multiple sets of attacks detected since December 2020 against high-profile entities in Europe and Asia. There is still little information about this actor, but its main distinctive signs are two formerly unknown tools that Kaspersky call ‘Samurai backdoor’ and ‘Ninja Trojan’.
Monitor for exploits on public-facing applications and spearphishing via service to detect initial access points.
Monitor for creation of Scheduled Tasks and Native API calls to detect execution of malicious code.
Monitor for use of Domain Accounts and creation of Hidden Windows to detect stealthy activity.
Monitor for enumeration of Domain Groups and Domain Account information to detect discovery activity.
Monitor for use of SMB/Windows Admin Shares to detect lateral movement.
Monitor for collection of Data from Local System and Remote Data Staging to detect data collection.
Monitor for Non-Application Layer Protocol to detect command and control activity.
Monitor for Exfiltration to Cloud Storage to detect data exfiltration.
Monitor for Disable or Modify System Firewall to detect impairment of defense mechanisms.
ToddyCat primarily targets military and government sectors in Europe and Asia.
ToddyCat uses 'Cobalt Strike', 'Samurai backdoor' and 'Ninja Trojan' tools.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.