LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1099: Samurai

Samurai is a passive backdoor that has been used by ToddyCat since at least 2020. Samurai allows arbitrary C# code execution and is used with multiple modules for remote administration and lateral movement.[1]

EnterpriseS1099MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Samurai matters because it represents a Windows passive backdoor capability tied in ATT&CK to remote administration, lateral movement support, arbitrary C# execution, and stealthy command-and-control patterns. For leaders, the decision value is not a single malware name; it is whether the organization can prove visibility into Windows service persistence, Registry activity, command shell execution, tool transfer, discovery, and unusual web or non-application-layer communications before an intrusion becomes hard to scope.

Executive priority

Prioritize Samurai as a readiness test for Windows endpoint visibility, SOC triage quality, and incident response containment. The ATT&CK record has no official detection guidance, so executives should ask whether existing EDR, network monitoring, service-change auditing, and Registry logging produce usable evidence for backdoor persistence, C2, discovery, and lateral-movement-enabling behavior. This is also useful audit evidence for control coverage around privileged system changes and malware response procedures.

Technical view

ATT&CK lists Samurai as Windows malware used by ToddyCat and associated with arbitrary C# code execution, modules for remote administration and lateral movement, and techniques including Windows Command Shell, Native API, Registry query/modify, Windows service persistence, file/software discovery, ingress tool transfer, proxying, web protocols, non-application-layer protocols, standard encoding, symmetric cryptography, compression, dynamic API resolution, compile-after-delivery, obfuscation, and resource-name/location masquerading. SOC and IR teams should validate detections around behavior chains rather than relying on a malware signature: suspicious service creation or modification followed by Registry changes, command shell execution, local discovery, payload/tool transfer, and abnormal outbound or internal proxy-like traffic.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry, especially cmd.exe and unusual child/parent process chains
  • Windows service creation, modification, startup configuration, and service executable path telemetry
  • Windows Registry query and modification events, especially persistence- or service-related keys
  • File creation, rename, compression/archive, compile-after-delivery, and suspicious placement in legitimate-looking paths
  • EDR or host telemetry for Native API usage patterns, dynamic API resolution indicators, and obfuscated payload behavior where available

Detection direction

  • Because MITRE provides no official detection text for Samurai, validate coverage against the related ATT&CK behaviors and local baselines rather than assuming product coverage.
  • Correlate Windows service changes with newly written binaries, suspicious paths or names, Registry modifications, and subsequent outbound communications.
  • Tune command shell and discovery detections to reduce noise from administrators and management tooling while retaining alerts for unusual execution context, timing, hosts, or chained activity.
  • Review whether network monitoring can distinguish routine web traffic from suspicious encoded, encrypted, proxied, or tool-transfer communications; expect encrypted or encoded C2 content to limit payload inspection.
  • Include detections for compile-after-delivery and obfuscation-adjacent behavior, such as unexpected compiler use, compressed payload staging, or files masquerading as legitimate resources.

Mitigation priorities

  • Harden and monitor Windows service creation and modification, especially where administrative privileges are required.
  • Restrict unnecessary command shell, compiler, and scripting access through least privilege and application control where operationally feasible.
  • Strengthen Registry auditing and change control for persistence-relevant locations.
  • Limit outbound connectivity and proxy paths to business-required destinations, and retain logs sufficient for C2 investigation.
  • Ensure EDR and central logging cover process, service, Registry, file, and network events on Windows systems in scope.
Additional notes and limits

The most useful defensive framing is a behavior-chain assessment: persistence through Windows services and Registry changes, execution through command shell or Native APIs, stealth through obfuscation/compression/API resolution/masquerading, discovery of local data and software, and C2 through web, proxy, non-application-layer, encoded, or encrypted channels. Related technique platform lists include non-Windows platforms because they are generic ATT&CK techniques; the Samurai software object itself is supplied as Windows.

This take is limited to the supplied ATT&CK STIX fields, external references, and relationships. MITRE does not provide official detection guidance, aliases, labels, or explicit tactics for the Samurai software object in the supplied data. No local indicators, hashes, infrastructure, prevalence, active exploitation status, or customer exposure can be inferred from this record alone.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Samurai

Samurai is a passive backdoor that has been used by ToddyCat since at least 2020. Samurai allows arbitrary C# code execution and is used with multiple modules for remote administration and lateral movement.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

19 rows
DomainIDNameRelationship / procedure
EnterpriseT1105Ingress Tool Transfer

Samurai has been used to deploy other malware including Ninja.[1]

EnterpriseT1095Non-Application Layer Protocol

Samurai can use a proxy module to forward TCP packets to external hosts.[1]

EnterpriseT1543.003Windows ServiceSub-technique

Samurai can create a service at `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost` to trigger execution and maintain persistence.[1]

EnterpriseT1573.001Symmetric CryptographySub-technique

Samurai can encrypt C2 communications with AES.[1]

EnterpriseT1083File and Directory Discovery

Samurai can use a specific module for file enumeration.[1]

EnterpriseT1027.015CompressionSub-technique

Samurai can deliver its final payload as a compressed, encrypted and base64-encoded blob.[1]

EnterpriseT1112Modify Registry

The Samurai loader component can create multiple Registry keys to force the svchost.exe process to load the final backdoor.[1]

EnterpriseT1027.004Compile After DeliverySub-technique

Samurai can compile and execute downloaded modules at runtime.[1]

EnterpriseT1132.001Standard EncodingSub-technique

Samurai can base64 encode data sent in C2 communications prior to its encryption.[1]

EnterpriseT1012Query Registry

Samurai can query `SOFTWARE\Microsoft\.NETFramework\policy\v2.0` for discovery.[1]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

Samurai has created the directory `%COMMONPROGRAMFILES%\Microsoft Shared\wmi\` to contain DLLs for loading successive stages.[1]

EnterpriseT1090Proxy

Samurai has the ability to proxy connections to specified remote IPs and ports through a a proxy module.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

Samurai can use a remote command module for execution via the Windows command line.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

Samurai can use a .NET HTTPListener class to receive and handle HTTP POST requests.[1]

EnterpriseT1027.007Dynamic API ResolutionSub-technique

Samurai can encrypt API name strings with an XOR-based algorithm.[1]

EnterpriseT1027Obfuscated Files or Information

Samurai can encrypt the names of requested APIs.[1]

EnterpriseT1106Native API

Samurai has the ability to call Windows APIs.[1]

EnterpriseT1005Data from Local System

Samurai can leverage an exfiltration module to download arbitrary files from compromised machines.[1]

EnterpriseT1518Software Discovery

Samurai can check for the presence and version of the .NET framework.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G1022: ToddyCat

ToddyCat is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia.[1][2]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1095: Non-Application Layer ProtocolEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1027.015: CompressionEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1027.004: Compile After DeliveryEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · GroupG1022: ToddyCatEnterpriseuses · TechniqueT1090: ProxyEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1027.007: Dynamic API ResolutionEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1518: Software DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
f7991cf87e7e5096...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundlef7991cf87e7e…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  2. [2]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  3. [3]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  4. [4]
    mitre-attackS1099
    Open source URL
  5. [5]
    mitre-attackS1099
    Open source URL
  6. [6]
    mitre-attackS1099
    Open source URL
  7. [7]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  8. [8]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  9. [9]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  10. [10]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  11. [11]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  12. [12]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  13. [13]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  14. [14]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  15. [15]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  16. [16]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  17. [17]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  18. [18]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  19. [19]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  20. [20]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  21. [21]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  22. [22]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  23. [23]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  24. [24]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  25. [25]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  26. [26]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  27. [27]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  28. [28]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  29. [29]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  30. [30]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  31. [31]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  32. [32]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  33. [33]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  34. [34]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  35. [35]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  36. [36]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  37. [37]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  38. [38]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  39. [39]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  40. [40]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use