ToddyCat

Executive Summary

ToddyCat (aka Websiic) is a sophisticated cyber threat actor targeting government and military sectors across Europe and Asia since at least 2020. Known for employing custom malware loaders and multi-stage infection chains, ToddyCat has demonstrated high technical skill in compromising sensitive infrastructure through targeted campaigns.

Goals & Targeting

ToddyCat primarily targets government and military sectors, suggesting a focus on espionage, data theft, or disruption of national security infrastructure. The group's targeting strategy appears to be region-agnostic, with operations observed in European and Asian countries. ToddyCat's choice of victims indicates an interest in high-value targets with access to sensitive information, likely aiming to achieve strategic or intelligence gains through their campaigns.

ToddyCat is a highly sophisticated cyber threat group that has been actively exploiting government and military targets across Europe and Asia since as early as 2020. The group is known for its use of custom loaders and malware, employing multi-stage infection chains to penetrate target networks. ToddyCat's operations typically involve advanced persistence mechanisms and exfiltration techniques, leveraging tools such as Cobalt Strike and China Chopper for command and control (C2). The group has demonstrated a strong focus on maintaining long-term access to victim networks, often using these footholds to steal sensitive data or disrupt critical systems. Kaspersky reports indicate that ToddyCat's activities have evolved significantly over time, with recent campaigns showing refined tactics such as the use of hidden windows and remote execution frameworks.

Key Capabilities

• Custom malware loaders
• Multi-stage infection chains
• Advanced persistence mechanisms
• Command and control (C2) frameworks
• Data exfiltration techniques
• Network traversal and lateral movement

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

ToddyCat's campaigns have focused on persistent access to victim networks, with a notable campaign titled 'making holes in your infrastructure.' The group has been observed using tools like Pcexter for backdooring systems and Samurai for lateral movement. Campaign patterns include the use of remote administration tools (RATs) for long-term control, and ToddyCat appears to favor exfiltration via cloud storage services. Notable operations have targeted government websites and military infrastructure across multiple regions.

IOC Patterns

• Spear-phishing with macro-laced Office documents
• C2 communication over legitimate domains and URLs
• Staging infrastructure on fast-flux domains
• Use of custom malware loaders for initial penetration
• Exfiltration via cloud storage services
• Scheduled tasks for persistence

Recommended Actions

• Implement network monitoring for known ToddyCat-related IPs and domains.
• Secure remote access points with multi-factor authentication (MFA).
• Segment critical government/military networks from general corporate infrastructure.
• Deploy endpoint detection and response (EDR) tools to detect advanced persistence frameworks.
• Train employees on recognizing spear-phishing attempts and suspicious email patterns.
• Regularly update software and patch known vulnerabilities to mitigate exploitation.

Suggested Tags