LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G1022: ToddyCat

ToddyCat is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia.[1][2]

EnterpriseG1022GroupObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

ToddyCat matters as a planning case for targeted, multi-stage intrusions where custom malware, common administration utilities, web shells, credential use, discovery, lateral movement, collection, staging, and exfiltration can blend into normal enterprise operations. ATT&CK does not provide group-level platforms, tactics, or detection guidance for this object, but the linked software and techniques point defenders toward validating Windows administration telemetry, domain account activity, SMB/WMI movement, file discovery, staging, and outbound transfer evidence.

Executive priority

For leadership, the decision value is not to treat ToddyCat as a single malware alert. The ATT&CK relationships show a chain of behaviors that can stress identity governance, Windows endpoint visibility, log retention, incident response readiness, and evidence needed for audit or post-incident review. Priority questions: can the organization prove who used domain accounts, where remote administration occurred, what files were collected or staged, and whether data left the environment?

Technical view

SOC and IR teams should map coverage across the related behaviors: China Chopper web shell presence, use of Windows utilities such as Net, Ping, and netstat, Cobalt Strike-like post-exploitation activity, ToddyCat-associated Samurai, Ninja, LoFiSe, and Pcexter, and techniques including PowerShell, Windows command shell, WMI, scheduled tasks, SMB/admin shares, domain account and group discovery, file/directory discovery, local data collection, remote staging, and exfiltration-oriented tooling. Because official detection text is not provided, validation should rely on local telemetry testing, baseline comparisons, and correlation across identity, endpoint, network, and server logs rather than a single indicator.

Likely telemetry

  • Endpoint process creation and command-line logging for PowerShell, cmd, Net, Ping, netstat, schtasks, and WMI-related execution
  • Windows security events for domain account logons, privileged group queries, and remote authentication
  • SMB/admin share access logs and file share auditing
  • Scheduled task creation, modification, and execution records
  • Web server logs and file integrity evidence relevant to web shell placement such as China Chopper

Detection direction

  • Correlate discovery commands, domain enumeration, remote execution, SMB access, and file staging instead of treating each utility execution as independently malicious.
  • Tune detections for unusual use of legitimate Windows administration tools by non-admin users, outside normal maintenance windows, or from atypical hosts.
  • Validate visibility into WMI, PowerShell, command shell, and scheduled tasks; these are common blind spots when only basic endpoint logging is enabled.
  • Review web-facing server monitoring for web shell indicators and unexpected server-side scripts or files, especially where China Chopper-like behavior would not require a victim host to call back.
  • Use identity context to distinguish expected administration from suspicious domain account use, group discovery, and lateral movement.

Mitigation priorities

  • Start with identity controls: least privilege for domain accounts, strong authentication where applicable, privileged access review, and monitoring of admin group membership and remote logons.
  • Harden and monitor remote administration paths, especially SMB/admin shares, WMI, PowerShell, command shell, and scheduled tasks.
  • Improve endpoint and server logging before relying on signatures, since the official ATT&CK object does not provide detection logic.
  • Segment critical systems and restrict unnecessary lateral movement paths between workstations, servers, and sensitive file repositories.
  • Strengthen web server hardening and file integrity monitoring where web shells would create durable access.
Additional notes and limits

This take is based on the ATT&CK ToddyCat group object and its supplied relationships. The object describes ToddyCat as active since at least 2020, using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia, with references to Kaspersky reporting. Relationship context links the group to Windows-oriented tools and malware such as Samurai, Ninja, LoFiSe, Pcexter, China Chopper, Net, and Cobalt Strike, plus discovery, execution, lateral movement, credential/account abuse, collection, staging, and local data access techniques.

ATT&CK provides no official detection text, no group-level platforms, and no group-level tactics in the supplied fields. Related techniques include platforms beyond Windows, while several related software objects are Windows-focused; local asset scope must determine relevance. This summary does not establish current activity, attribution beyond the ATT&CK group object, customer exposure, or guaranteed detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

ToddyCat

ToddyCat is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

25 rows
DomainIDNameRelationship / procedure
EnterpriseT1686Disable or Modify System Firewall

Prior to executing a backdoor ToddyCat has run `cmd /c start /b netsh advfirewall firewall add rule name="SGAccessInboundRule" dir=in protocol=udp action=allow localport=49683` to allow the targeted system to receive UDP packets on port 49683.[2]

EnterpriseT1005Data from Local System

ToddyCat has run scripts to collect documents from targeted hosts.[2]

EnterpriseT1069.002Domain GroupsSub-technique

ToddyCat has executed `net group "domain admins" /dom` for discovery on compromised machines.[2]

EnterpriseT1053.005Scheduled TaskSub-technique

ToddyCat has used scheduled tasks to execute discovery commands and scripts for collection.[2]

EnterpriseT1566.003Spearphishing via ServiceSub-technique

ToddyCat has sent loaders configured to run Ninja as zip archives via Telegram.[1]

EnterpriseT1087.002Domain AccountSub-technique

ToddyCat has run `net user %USER% /dom` for account discovery.[2]

EnterpriseT1095Non-Application Layer Protocol

ToddyCat has used a passive backdoor that receives commands with UDP packets.[2]

EnterpriseT1078.002Domain AccountsSub-technique

ToddyCat has used compromised domain admin credentials to mount local network shares.[2]

EnterpriseT1106Native API

ToddyCat has used `WinExec` to execute commands received from C2 on compromised hosts.[2]

EnterpriseT1057Process Discovery

ToddyCat has run `cmd /c start /b tasklist` to enumerate processes.[2]

EnterpriseT1018Remote System Discovery

ToddyCat has used `ping %REMOTE_HOST%` for post exploit discovery.[2]

EnterpriseT1049System Network Connections Discovery

ToddyCat has used `netstat -anop tcp` to discover TCP connections to compromised hosts.[2]

EnterpriseT1021.002SMB/Windows Admin SharesSub-technique

ToddyCat has used locally mounted network shares for lateral movement through targated environments.[2]

EnterpriseT1059.003Windows Command ShellSub-technique

ToddyCat has used .bat scripts and `cmd` for execution on compromised hosts.[2]

EnterpriseT1190Exploit Public-Facing Application

ToddyCat has exploited the ProxyLogon vulnerability (CVE-2021-26855) to compromise Exchange Servers at multiple organizations.[1]

EnterpriseT1567.002Exfiltration to Cloud StorageSub-technique

ToddyCat has used a DropBox uploader to exfiltrate stolen files.[2]

EnterpriseT1518.001Security Software DiscoverySub-technique

ToddyCat can determine is Kaspersky software is running on an endpoint by running `cmd /c wmic process where name="avp.exe"`.[2]

EnterpriseT1059.001PowerShellSub-technique

ToddyCat has used Powershell scripts to perform post exploit collection.[2]

EnterpriseT1564.003Hidden WindowSub-technique

ToddyCat has hidden malicious scripts using `powershell.exe -windowstyle hidden`. [2]

EnterpriseT1083File and Directory Discovery

ToddyCat has run scripts to enumerate recently modified documents having either a .pdf, .doc, .docx, .xls or .xlsx extension.[2]

EnterpriseT1074.002Remote Data StagingSub-technique

ToddyCat manually transferred collected files to an exfiltration host using xcopy.[2]

EnterpriseT1047Windows Management Instrumentation

ToddyCat has used WMI to execute scripts for post exploit document collection.[2]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

ToddyCat has used the name `debug.exe` for malware components.[1]

EnterpriseT1680Local Storage Discovery

ToddyCat has collected information on bootable drives including model, vendor, and serial numbers.[2]

EnterpriseT1560.001Archive via UtilitySub-technique

ToddyCat has leveraged xcopy, 7zip, and RAR to stage and compress collected documents prior to exfiltration.[2]

Associated objects

Groups, software, and campaigns

MalwareEnterprise

S0154: Cobalt Strike

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.[1]

In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz.[1]

LinuxmacOSWindows
ToolEnterprise

S0104: netstat

netstat is an operating system utility that displays active TCP connections, listening ports, and network statistics. [1]

ToolEnterprise

S0097: Ping

Ping is an operating system utility commonly used to troubleshoot and verify network connections. [1]

ToolEnterprise

S0039: Net

The Net utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. [1]

Net has a great deal of functionality, [2] much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through SMB/Windows Admin Shares using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.

Windows
MalwareEnterprise

S1099: Samurai

Samurai is a passive backdoor that has been used by ToddyCat since at least 2020. Samurai allows arbitrary C# code execution and is used with multiple modules for remote administration and lateral movement.[1]

Windows
MalwareEnterprise

S1100: Ninja

Ninja is a malware developed in C++ that has been used by ToddyCat to penetrate networks and control remote systems since at least 2020. Ninja is possibly part of a post exploitation toolkit exclusively used by ToddyCat and allows multiple operators to work simultaneously on the same machine. Ninja has been used against government and military entities in Europe and Asia and observed in specific infection chains being deployed by Samurai.[1]

Windows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1686: Disable or Modify System FirewallEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1069.002: Domain GroupsEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · MalwareS0154: Cobalt StrikeEnterpriseuses · TechniqueT1566.003: Spearphishing via ServiceEnterpriseuses · MalwareS1101: LoFiSeEnterpriseuses · TechniqueT1087.002: Domain AccountEnterpriseuses · TechniqueT1095: Non-Application Layer ProtocolEnterpriseuses · TechniqueT1078.002: Domain AccountsEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · MalwareS0020: China ChopperEnterpriseuses · ToolS0104: netstatEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1018: Remote System DiscoveryEnterpriseuses · TechniqueT1049: System Network Connections DiscoveryEnterpriseuses · TechniqueT1021.002: SMB/Windows Admin SharesEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1190: Exploit Public-Facing ApplicationEnterpriseuses · TechniqueT1567.002: Exfiltration to Cloud StorageEnterpriseuses · ToolS0097: PingEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1564.003: Hidden WindowEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
185e28022b0e3103...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle185e28022b0e…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  2. [2]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  3. [3]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  4. [4]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  5. [5]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  6. [6]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  7. [7]
    mitre-attackG1022
    Open source URL
  8. [8]
    mitre-attackG1022
    Open source URL
  9. [9]
    mitre-attackG1022
    Open source URL
  10. [10]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  11. [11]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  12. [12]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  13. [13]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  14. [14]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  15. [15]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  16. [16]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  17. [17]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  18. [18]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  19. [19]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  20. [20]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  21. [21]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  22. [22]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  23. [23]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  24. [24]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  25. [25]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  26. [26]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  27. [27]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  28. [28]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  29. [29]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  30. [30]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  31. [31]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  32. [32]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  33. [33]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  34. [34]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  35. [35]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  36. [36]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  37. [37]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  38. [38]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  39. [39]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  40. [40]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  41. [41]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  42. [42]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  43. [43]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  44. [44]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  45. [45]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  46. [46]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  47. [47]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  48. [48]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  49. [49]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  50. [50]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  51. [51]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  52. [52]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  53. [53]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  54. [54]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  55. [55]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  56. [56]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  57. [57]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  58. [58]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  59. [59]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  60. [60]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  61. [61]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  62. [62]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  63. [63]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  64. [64]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  65. [65]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  66. [66]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  67. [67]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  68. [68]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  69. [69]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  70. [70]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  71. [71]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  72. [72]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  73. [73]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  74. [74]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use