ToddyCat
Essential information
- Confidence
- 100/100
- Published
- 16/12/2025 19:39
- Modified
- 27/03/2026 01:13
- Updated at
- 27/03/2026 01:13
- Revoked
- No
- Author / Source
- The MITRE Corporation
- Resource level
- —
- Primary motivation
- —
- Related entities
- 2 reports, 54 attack patterns (mitre), 12 malware, 1 sectors, 13 countries, 73 indicators, 3 tool
Description
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.
Reports (2)
-
3 MITREs 1 APT
-
2 Malwares 1 APT
Attack patterns (MITRE) (54)
-
T1574 usesHijack Execution Flow MITRE
-
T1564.003 usesHidden Window MITRE
-
T1555.003 usesCredentials from Web Browsers MITRE
-
T1518.001 usesSecurity Software Discovery MITRE
-
T1073 uses
-
T1574.002 uses
-
T1550.001 usesApplication Access Token MITRE
-
T1057 usesProcess Discovery MITRE
-
T1069.002 usesDomain Groups MITRE
-
T1053.005 usesScheduled Task MITRE
-
T1005 usesData from Local System MITRE
-
T1560.001 usesArchive via Utility MITRE
Malware (12)
-
Ninja usesFamily The MITRE Corporation Confidence 100
[Ninja](https://attack.mitre.org/software/S1100) is a malware developed in C++ that has been used by [ToddyCat](https://attack.mitre.org/groups/G1022) to penetrate networks and control remote systems since at least 2020. [Ninja](https://attack.mitre.org/software/S1100) is possibly part…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Pcexter usesFamily The MITRE Corporation Confidence 100
[Pcexter](https://attack.mitre.org/software/S1102) is an uploader that has been used by [ToddyCat](https://attack.mitre.org/groups/G1022) since at least 2023 to exfiltrate stolen files.(Citation: Kaspersky ToddyCat Check Logs October 2023)
First seen 01/01/1970 · Last seen 16/11/5138 · -
Cobalt Strike usesFamily The MITRE Corporation Confidence 100
[Cobalt Strike](https://attack.mitre.org/software/S0154) is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced…
First seen 01/01/1970 · Last seen 16/11/5138 · -
cuthead usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
HackTool:MSIL/Ninja usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
China Chopper usesFamily The MITRE Corporation Confidence 100
[China Chopper](https://attack.mitre.org/software/S0020) is a [Web Shell](https://attack.mitre.org/techniques/T1505/003) hosted on Web servers to provide access back into an enterprise network that does not rely on an infected system calling back…
First seen 01/01/1970 · Last seen 16/11/5138 · -
TomBerBil usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Samurai usesFamily The MITRE Corporation Confidence 100
[Samurai](https://attack.mitre.org/software/S1099) is a passive backdoor that has been used by [ToddyCat](https://attack.mitre.org/groups/G1022) since at least 2020. [Samurai](https://attack.mitre.org/software/S1099) allows arbitrary C# code execution and is used with multiple modules for…
First seen 01/01/1970 · Last seen 16/11/5138 · -
EDRSandBlast usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
TCESB usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
LoFiSe usesFamily The MITRE Corporation Confidence 100
[LoFiSe](https://attack.mitre.org/software/S1101) has been used by [ToddyCat](https://attack.mitre.org/groups/G1022) since at least 2023 to identify and collect files of interest on targeted systems.(Citation: Kaspersky ToddyCat Check Logs October 2023)
First seen 01/01/1970 · Last seen 16/11/5138 · -
WAExp usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Sectors (1)
-
Telecommunications targets
Countries (13)
-
Malaysia targets
Indicators (73)
-
imap.774b884034c450b.comindicates -
a8a026d9bda80cc9bdd778a6ea8c88edcb2d657dc481952913bbdb5f2bfc11c9indicates -
778b2526965dc1c4bcc401d0ae92037122e7e7f2c41f042f95b59a7f0fe6f30eindicates -
pkigoscorp.comindicates -
7418c4d96cb0fe41fc95c0a27d2364ac45eb749d7edbe0ab339ea954f86abf9eindicates -
60030b970491bced72a56c9dde09a1d2260becfbf80a2b0d217a0b913e781c3aindicates -
6eaa33812365865512044020bc4b95079a1cc2ddc26cdadf24a9ff76c81b1746indicates -
732621aa53683c16edf3959dfe9d93de5359c431c130784b31d4a598fbbd80a9indicates -
c4f9bc7624509190e9e2a690daeff5ac9e944f094b51781734b83a364ae038d0indicates -
2ab1121c603b925548a823fa18193896cd24d186e08957393e6a34d697aed782indicates -
d4bd89ff56b75fc617f83eb858b6dbce7b36376889b07fa0c2417322ca361c30indicates -
gist.gitbusercontent.comindicates
Tool (3)
-
Net usesThe MITRE Corporation Confidence 100
The [Net](https://attack.mitre.org/software/S0039) utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. (Citation: Microsoft…
-
netstat usesThe MITRE Corporation Confidence 100
[netstat](https://attack.mitre.org/software/S0104) is an operating system utility that displays active TCP connections, listening ports, and network statistics. (Citation: TechNet Netstat)
-
Ping usesThe MITRE Corporation Confidence 100
[Ping](https://attack.mitre.org/software/S0097) is an operating system utility commonly used to troubleshoot and verify network connections. (Citation: TechNet Ping)