Introducing ToyMaker
Essential information
- Published
- 23/04/2025 22:12
- Modified
- 23/04/2025 22:56
- Tags
- 2025-04-23 anydesk bugsleep cactus capture file transfer holerun impacket initial access broker lagtoy magnet ram metasploit persistence powershell ransomware ssh toymaker winscp
- Related entities
- 20 observables, 6 techniques (mitre), 2 malware
Description
The initial access broker (IAB), whom Talos calls “ToyMaker” and assesses with medium confidence is a financially motivated threat actor, exploits vulnerable systems exposed to the internet. They deploy their custom-made backdoor we call “LAGTOY” and extract credentials from the victim enterprise. LAGTOY can be used to create reverse shells and execute commands on infected endpoints.