LoFiSe

Executive Summary

LoFiSe is a Windows tool used by ToddyCat to locate and gather specific files from compromised systems. The malware performs low‑profile file discovery and staging for exfiltration, enabling the actor to collect targeted data without triggering many traditional detection methods. Security teams should monitor for unexplained activity within critical directories and block unauthorized outbound transfers involving user‑generated content.

LoFiSe is a Windows‑based malware component that has been observed in campaigns attributed to the threat actor ToddyCat since at least 2023. During intrusion, LoFiSe scans local file systems for documents and other artefacts deemed valuable by the attackers. Once identified, the files are copied or staged for exfiltration, allowing investigators to see which types of data the adversaries prioritize. The tool has been designed with a low‑profile footprint; it avoids creating obvious persistence mechanisms and instead relies on existing legitimate processes to carry out its activities. Because LoFiSe operates as an ancillary collection module rather than the primary malware payload, its behavior is relatively simple but effective. By focusing solely on discovery and collection, it can remain undetected by conventional anti‑virus engines while still providing a valuable data‑gleaning function for threat actors.

Key Capabilities

• File system enumeration
• Selective collection based on file type or location
• Low‑profile execution leveraging legitimate processes
• Data staging for exfiltration

ATT&CK Techniques

Recommended Actions

• Deploy endpoint detection and response (EDR) to monitor for unusual file read/write patterns on protected directories.
• Implement application whitelisting and restrict execution of unknown binaries in administrative paths.
• Use network segmentation and monitor outbound traffic for abnormal data sizes or connections to suspicious hosts. "Detect and block known LoFiSe file hashes or strings via host intrusion prevention systems, and reference Kaspersky threat intelligence for updated signatures."

Suggested Tags