ToddyCat
- ID
- G1022
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
ToddyCat is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia.[1][2]
Techniques used (25)
- T1005 Data from Local System
- T1018 Remote System Discovery
- T1021.002 SMB/Windows Admin Shares
- T1036.005 Match Legitimate Resource Name or Location
- T1047 Windows Management Instrumentation
- T1049 System Network Connections Discovery
- T1053.005 Scheduled Task
- T1057 Process Discovery
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1069.002 Domain Groups
- T1074.002 Remote Data Staging
- T1078.002 Domain Accounts
- T1083 File and Directory Discovery
- T1087.002 Domain Account
- T1095 Non-Application Layer Protocol
- T1106 Native API
- T1190 Exploit Public-Facing Application
- T1518.001 Security Software Discovery
- T1560.001 Archive via Utility
- T1564.003 Hidden Window
- T1566.003 Spearphishing via Service
- T1567.002 Exfiltration to Cloud Storage
- T1680 Local Storage Discovery
- T1686 Disable or Modify System Firewall
Software used (9)
- S0020 China Chopper
- S0039 Net
- S0097 Ping
- S0104 netstat
- S0154 Cobalt Strike
- S1099 Samurai
- S1100 Ninja
- S1101 LoFiSe
- S1102 Pcexter