Watch Floor
CybercrimeMITRE G1022

ToddyCat

Also known as Websiic

0mentions, 7 days
0mentions, 30 days
nonelast mentioned

ToddyCat is responsible for multiple sets of attacks detected since December 2020 against high-profile entities in Europe and Asia. There is still little information about this actor, but its main distinctive signs are two formerly unknown tools that Kaspersky call ‘Samurai backdoor’ and ‘Ninja Trojan’.

Targets: Military, Government, Afghanistan, India, Indonesia, Iran, Kyrgyzstan, Malaysia, Pakistan, Russia, Slovakia, Taiwan, Thailand, United Kingdom, Uzbekistan

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1005 Data from Local SystemT1018 Remote System DiscoveryT1021.002 SMB/Windows Admin SharesT1036.005 Match Legitimate Resource Name or LocationT1047 Windows Management InstrumentationT1049 System Network Connections DiscoveryT1053.005 Scheduled TaskT1057 Process DiscoveryT1059.001 PowerShellT1059.003 Windows Command ShellT1069.002 Domain GroupsT1074.002 Remote Data StagingT1078.002 Domain AccountsT1083 File and Directory DiscoveryT1087.002 Domain AccountT1095 Non-Application Layer ProtocolT1106 Native APIT1190 Exploit Public-Facing ApplicationT1518.001 Security Software DiscoveryT1560.001 Archive via UtilityT1564.003 Hidden WindowT1566.003 Spearphishing via ServiceT1567.002 Exfiltration to Cloud StorageT1680 Local Storage DiscoveryT1686 Disable or Modify System Firewall

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.