Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · ToddyCat · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

ToddyCat

  • Websiic

MITRE G1022 ↗

ToddyCat — ATT&CK roseTO

attack rose · 25 techniques across 9 tactics

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2021-26855

Analyst brief

misp-galaxy + mitre-attack

ToddyCat is responsible for multiple sets of attacks detected since December 2020 against high-profile entities in Europe and Asia. There is still little information about this actor, but its main distinctive signs are two formerly unknown tools that Kaspersky call ‘Samurai backdoor’ and ‘Ninja Trojan’.

Observed targets (as stated by the sources)

14 countries · 2 sectors
AfghanistanIndiaIndonesiaIranKyrgyzstanMalaysiaPakistanRussiaSlovakiaTaiwanThailandUnited KingdomUzbekistanVietnam

assessed originnot stated by sourcesobserved targets · 14

countries · 14

  • Afghanistan
  • India
  • Indonesia
  • Iran
  • Kyrgyzstan
  • Malaysia
  • Pakistan
  • Russia
  • Slovakia
  • Taiwan
  • Thailand
  • United Kingdom
  • Uzbekistan
  • Vietnam

sectors · 2

  • Military
  • Government

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

25 techniques · 9 of 15 tactics

  1. Initial access

    2 techniques

  2. Execution

    5 techniques

  3. Stealth

    3 techniques

  4. Defense impairment

    1 technique

  5. Discovery

    8 techniques

  6. Lateral movement

    1 technique

  7. Collection

    3 techniques

  8. Command and control

    1 technique

  9. Exfiltration

    1 technique

select a technique

Arsenal

6 malware · 3 tools
Malware
Malware · 6ATT&CK
Cobalt StrikeS0154 ↗
LoFiSeS1101 ↗
China ChopperS0020 ↗
PcexterS1102 ↗
SamuraiS1099 ↗
NinjaS1100 ↗
Tools
Tools · 3ATT&CK
netstatS0104 ↗
PingS0097 ↗
NetS0039 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs ToddyCat is cited as exploiting

none on KEV
  1. CVE-2021-268552026-10-17
    1. “ToddyCat has exploited the ProxyLogon vulnerability (CVE-2021-26855) to compromise Exchange Servers at multiple organizations.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

8 sources
  1. 1.bleepingcomputer.com/news/security/new-toddycat-apt-group-targets-exchange-…
  2. 2.securelist.com/toddycat/106799
  3. 3.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups
  4. 4.gteltsc.vn/blog/cap-nhat-nhe-ve-lo-hong-bao-mat-0day-microsoft-ex…
  5. 5.community.riskiq.com/article/d8b749f2
  6. 6.teamt5.org/en/posts/assassinations-of-minininja-in-various-apac-c…
  7. 7.attack.mitre.org/groups/G1022
  8. 8.securelist.com/toddycat-keep-calm-and-check-logs/110696

Track ToddyCat on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.