ToddyCat

Techniques (MITRE ATT&CK)25

SourceMITRE ATT&CK

Target categories: Military, Government

Targeted regions: Afghanistan · India · Indonesia · Iran · Kyrgyzstan · Malaysia · Pakistan · Russia · Slovakia · Taiwan +4

Vexday analysis

ToddyCat é um grupo APT sofisticado, ativo desde pelo menos 2020, que utiliza carregadores e malwares personalizados em cadeias de infecção multiestágio contra alvos governamentais e militares na Europa e na Ásia. O grupo possui 25 técnicas documentadas no MITRE ATT&CK (identificador G1022) e é associado à exploração de 3 CVEs.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity55

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 25

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Initial access

Exploit Public-Facing Application Spearphishing via Service

Execution

Windows Management Instrumentation Scheduled Task PowerShell Windows Command Shell Native API

Discovery

Remote System Discovery System Network Connections Discovery Process Discovery Domain Groups File and Directory Discovery Domain Account Security Software Discovery Local Storage Discovery

Lateral movement

SMB/Windows Admin Shares

Collection

Data from Local System Remote Data Staging Archive via Utility

Command and control

Non-Application Layer Protocol

Exfiltration

Exfiltration to Cloud Storage

defense-impairment

Disable or Modify System Firewall

stealth

Match Legitimate Resource Name or Location Domain Accounts Hidden Window

Exploited vulnerabilities 3

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2021-26855CRITICALEPSS 100%KEV CVE-2014-7169CRITICALEPSS 100%KEV CVE-2016-6662EPSS 68%

Known infrastructure 1255

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

ip:port68.64.182.169:110Cobalt Strikethreatfox

ip:port68.64.182.169:465Cobalt Strikethreatfox

ip:port101.42.255.92:8443Cobalt Strikethreatfox

ip:port68.64.182.169:995Cobalt Strikethreatfox

ip:port68.64.182.169:7000Cobalt Strikethreatfox

ip:port68.64.182.169:8000Cobalt Strikethreatfox

ip:port68.64.182.169:7010Cobalt Strikethreatfox

ip:port8.163.59.20:22Cobalt Strikethreatfox

ip:port178.128.80.204:22Cobalt Strikethreatfox

ip:port68.64.182.169:4190Cobalt Strikethreatfox

ip:port68.64.182.169:993Cobalt Strikethreatfox

ip:port91.92.42.118:13019Cobalt Strikethreatfox

ip:port118.31.18.77:2301Cobalt Strikethreatfox

ip:port119.29.122.42:8080Cobalt Strikethreatfox

ip:port68.64.182.169:587Cobalt Strikethreatfox

ip:port119.29.122.42:80Cobalt Strikethreatfox

ip:port119.29.122.42:443Cobalt Strikethreatfox

ip:port68.64.182.169:3306Cobalt Strikethreatfox

ip:port68.64.182.169:8010Cobalt Strikethreatfox

ip:port68.64.182.169:5727Cobalt Strikethreatfox

ip:port68.64.182.169:111Cobalt Strikethreatfox

ip:port68.64.182.169:443Cobalt Strikethreatfox

ip:port68.64.182.169:8080Cobalt Strikethreatfox

ip:port159.75.123.199:21Cobalt Strikethreatfox

ip:port68.64.183.127:8090Cobalt Strikethreatfox

ip:port68.64.183.127:5555Cobalt Strikethreatfox

ip:port139.196.217.227:80Cobalt Strikethreatfox

ip:port159.75.123.199:5003Cobalt Strikethreatfox

ip:port156.239.47.245:80Cobalt Strikethreatfox

ip:port156.239.47.245:8080Cobalt Strikethreatfox

+1255 indicators in total. See them all on the IOCs page.

References

ToddyCat uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →