← Back to Actors
ToddyCat
ToddyCat
[ToddyCat](https://attack.mitre.org/groups/G1022) is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kaspersky ToddyCat Check Logs October 2023)
26
Techniques
25
Covered
1
Gaps
96%
Coverage
Coverage25/26
GAPS (1)
COVERED (25)
T1005Data from Local System51 det.T1018Remote System Discovery52 det.T1021.002SMB/Windows Admin Shares74 det.T1036.005Match Legitimate Resource Name or Location49 det.T1047Windows Management Instrumentation88 det.T1049System Network Connections Discovery23 det.T1053.005Scheduled Task100 det.T1057Process Discovery24 det.T1059.001PowerShell384 det.T1059.003Windows Command Shell89 det.T1069.002Domain Groups45 det.T1074.002Remote Data Staging3 det.T1078.002Domain Accounts28 det.T1083File and Directory Discovery49 det.T1087.002Domain Account58 det.T1095Non-Application Layer Protocol26 det.T1106Native API30 det.T1190Exploit Public-Facing Application240 det.T1518.001Security Software Discovery11 det.T1560.001Archive via Utility27 det.T1562.004Disable or Modify System Firewall50 det.T1564.003Hidden Window11 det.T1566.003Spearphishing via Service107 det.T1567.002Exfiltration to Cloud Storage33 det.T1686Disable or Modify System Firewall19 det.