MITRE ATT&CKgroup

G1022 ToddyCat

Published 2024-01-03 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.0
Created
2024-01-03

Description

ToddyCat is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia.

Related

Uses · MITRE ATT&CK (34)

  • T1686 Disable or Modify System Firewall technique
  • T1680 Local Storage Discovery technique
  • S1102 Pcexter software (malware)
  • S1101 LoFiSe software (malware)
  • S1100 Ninja software (malware)
  • S1099 Samurai software (malware)
  • T1074.002 Remote Data Staging sub-technique
  • T1078.002 Domain Accounts sub-technique
  • T1564.003 Hidden Window sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1567.002 Exfiltration to Cloud Storage sub-technique
  • T1566.003 Spearphishing via Service sub-technique
  • T1069.002 Domain Groups sub-technique
  • T1087.002 Domain Account sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1560.001 Archive via Utility sub-technique
  • T1021.002 SMB/Windows Admin Shares sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1190 Exploit Public-Facing Application technique
  • S0154 Cobalt Strike software (malware)
  • S0020 China Chopper software (malware)
  • S0039 Net software (tool)
  • S0097 Ping software (tool)
  • S0104 netstat software (tool)
  • T1005 Data from Local System technique
  • T1018 Remote System Discovery technique
  • T1047 Windows Management Instrumentation technique
  • T1049 System Network Connections Discovery technique
Show all 34 ›

References