LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1100: Ninja

Ninja is a malware developed in C++ that has been used by ToddyCat to penetrate networks and control remote systems since at least 2020. Ninja is possibly part of a post exploitation toolkit exclusively used by ToddyCat and allows multiple operators to work simultaneously on the same machine. Ninja has been used against government and military entities in Europe and Asia and observed in specific infection chains being deployed by Samurai.[1]

EnterpriseS1100MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Ninja is a Windows malware family associated in ATT&CK with ToddyCat and described as a C++ post-exploitation tool for penetrating networks and controlling remote systems. Its practical importance is not just the malware name: the mapped behaviors point to stealthy remote control, obfuscated command-and-control, host and network discovery, proxying, process injection, and Windows service persistence. For leaders, this is a reminder that coverage must be validated across endpoint, network, and incident response workflows, not only by file signatures.

Executive priority

Prioritize this as a post-compromise resilience scenario for Windows environments. Ask whether the organization can prove it collects the evidence needed to detect remote-control malware that blends into web traffic, uses proxy chains, hides artifacts, and persists as a service. The ATT&CK description references use against government and military entities in Europe and Asia and deployment by Samurai in specific infection chains, so threat intelligence teams should use this as context for sector and geography-aware prioritization without assuming local exposure.

Technical view

ATT&CK provides no official detection text for Ninja, so defenders should build behavior-based validation from the relationships. Key areas are command-and-control over web protocols, protocol or service impersonation, non-standard encoding, non-application-layer protocols, internal and multi-hop proxying; discovery of system, network, process, file, and directory information; stealth through encoded/encrypted or compressed files, deobfuscation, timestomping, masqueraded names or locations, process injection, native API use, Rundll32 abuse, and environmental keying; execution via malicious files; and persistence or privilege escalation through Windows services. Because the object platform is Windows, validation should focus on Windows endpoint and network telemetry first.

Likely telemetry

  • Windows endpoint process creation, command-line, parent-child process, and module/DLL execution telemetry, especially for Rundll32 patterns
  • Windows service creation, modification, service image path, recovery command, and related Registry configuration evidence
  • EDR or host sensor evidence for process injection, suspicious native API use, and cross-process memory activity
  • File creation and modification telemetry, including compressed, encrypted, encoded, or newly decoded artifacts
  • Filesystem timestamp evidence, including anomalies consistent with timestomping where available

Detection direction

  • Do not rely on a Ninja-specific signature alone; validate detections against the mapped ATT&CK behaviors because no official detection guidance is supplied.
  • Correlate weak signals: discovery activity followed by obfuscated outbound traffic, service creation, Rundll32 execution, process injection indicators, or suspicious file timestamp changes is more meaningful than any single event.
  • Tune Windows service and Rundll32 analytics carefully because both have legitimate administrative use; prioritize unusual paths, unexpected parents, rare command lines, and recent file creation or modification context.
  • For C2, look for web traffic that does not behave like normal web traffic, non-standard encoding, protocol impersonation, internal proxying, or unexpected non-application-layer communications.
  • Account for blind spots: encrypted or encoded payloads, compression, environmental keying, and timestomping can reduce the value of static file inspection and simple timestamp review.

Mitigation priorities

  • Start with telemetry assurance: confirm Windows endpoint, service, process, file, and network egress logging are collected and retained long enough for incident response.
  • Harden persistence and execution paths by monitoring and controlling service creation/modification, Rundll32 abuse, and execution from suspicious or user-writable locations.
  • Improve egress control and network visibility for web protocols, protocol impersonation, internal proxying, and unusual non-application-layer communications.
  • Use endpoint controls capable of observing process injection and suspicious native API behavior, not only file reputation.
  • Strengthen user-driven execution defenses and response processes for malicious-file execution scenarios.
Additional notes and limits

This take is based on ATT&CK S1100, its official description, the Kaspersky external reference, and the supplied relationships. The most decision-useful pattern is Ninja’s role as Windows post-exploitation malware with relationships spanning C2 obfuscation, discovery, stealth, execution, proxying, and persistence. Local prioritization should consider whether the organization resembles the referenced target context, but sector references should not be interpreted as exclusive targeting.

ATT&CK supplies no official detection section, no aliases, no specified tactics on the malware object itself, and no environment-specific indicators here. The related techniques provide behavioral direction but do not prove that every behavior will appear in every intrusion. Local telemetry, baselines, and incident evidence are required to assess exposure or detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Ninja

Ninja is a malware developed in C++ that has been used by ToddyCat to penetrate networks and control remote systems since at least 2020. Ninja is possibly part of a post exploitation toolkit exclusively used by ToddyCat and allows multiple operators to work simultaneously on the same machine. Ninja has been used against government and military entities in Europe and Asia and observed in specific infection chains being deployed by Samurai.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

28 rows
DomainIDNameRelationship / procedure
EnterpriseT1027.013Encrypted/Encoded FileSub-technique

The Ninja payload is XOR encrypted and compressed.[2] Ninja has also XORed its configuration data with a constant value of `0xAA`.[1][2]

EnterpriseT1095Non-Application Layer Protocol

Ninja can forward TCP packets between the C2 and a remote host.[1][2]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

Ninja has used legitimate looking filenames for its loader including update.dll and x64.dll.[2]

EnterpriseT1016System Network Configuration Discovery

Ninja can enumerate the IP address on compromised systems.[1]

EnterpriseT1566.003Spearphishing via ServiceSub-technique

Ninja has been distributed to victims via the messaging app Telegram.[1]

EnterpriseT1204.002Malicious FileSub-technique

Ninja has gained execution through victims opening malicious executable files embedded in zip archives.[1]

EnterpriseT1083File and Directory Discovery

Ninja has the ability to enumerate directory content.[1][2]

EnterpriseT1106Native API

The Ninja loader can call Windows APIs for discovery, process injection, and payload decryption.[1][2]

EnterpriseT1573.001Symmetric CryptographySub-technique

Ninja can XOR and AES encrypt C2 messages.[1]

EnterpriseT1029Scheduled Transfer

Ninja can configure its agent to work only in specific time frames.[1]

EnterpriseT1574.001DLLSub-technique

Ninja loaders can be side-loaded with legitimate and signed executables including the VLC.exe media player.[2]

EnterpriseT1082System Information Discovery

Ninja can obtain the computer name and information on the OS from targeted hosts.[1][2]

EnterpriseT1140Deobfuscate/Decode Files or Information

The Ninja loader component can decrypt and decompress the payload.[1][2]

EnterpriseT1001Data Obfuscation

Ninja has the ability to modify headers and URL paths to hide malicious traffic in HTTP requests.[1]

EnterpriseT1090.003Multi-hop ProxySub-technique

Ninja has the ability to use a proxy chain with up to 255 hops when using TCP.[1]

EnterpriseT1480.001Environmental KeyingSub-technique

Ninja can store its final payload in the Registry under `$HKLM\SOFTWARE\Classes\Interface\` encrypted with a dynamically generated key based on the drive’s serial number.[1]

EnterpriseT1090.001Internal ProxySub-technique

Ninja can proxy C2 communications including to and from internal agents without internet connectivity.[1][2]

EnterpriseT1680Local Storage Discovery

Ninja can obtain information on physical drives from targeted hosts.[1][2]

EnterpriseT1218.011Rundll32Sub-technique

Ninja loader components can be executed through rundll32.exe.[2]

EnterpriseT1055Process Injection

Ninja has the ability to inject an agent module into a new process and arbitrary shellcode into running processes.[1][2]

EnterpriseT1543.003Windows ServiceSub-technique

Ninja can create the services `httpsvc` and `w3esvc` for persistence .[1]

EnterpriseT1057Process Discovery

Ninja can enumerate processes on a targeted host.[1][2]

EnterpriseT1001.003Protocol or Service ImpersonationSub-technique

Ninja has the ability to mimic legitimate services with customized HTTP URL paths and headers to hide malicious traffic.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

Ninja can use HTTP for C2 communications.[1]

EnterpriseT1027.015CompressionSub-technique

Ninja has compressed its data with the LZSS algorithm.[1][2]

EnterpriseT1070.006TimestompSub-technique

Ninja can change or create the last access or write times.[1]

EnterpriseT1559Inter-Process Communication

Ninja can use pipes to redirect the standard input and the standard output.[1]

EnterpriseT1132.002Non-Standard EncodingSub-technique

Ninja can encode C2 communications with a base64 algorithm using a custom alphabet.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G1022: ToddyCat

ToddyCat is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia.[1][2]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1095: Non-Application Layer ProtocolEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1566.003: Spearphishing via ServiceEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1029: Scheduled TransferEnterpriseuses · TechniqueT1574.001: DLLEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1001: Data ObfuscationEnterpriseuses · TechniqueT1090.003: Multi-hop ProxyEnterpriseuses · TechniqueT1480.001: Environmental KeyingEnterpriseuses · TechniqueT1090.001: Internal ProxyEnterpriseuses · TechniqueT1680: Local Storage DiscoveryEnterpriseuses · TechniqueT1218.011: Rundll32Enterpriseuses · TechniqueT1055: Process InjectionEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1001.003: Protocol or Service ImpersonationEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
6f9565ea5e9a83c6...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle6f9565ea5e9a…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  2. [2]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  3. [3]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  4. [4]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  5. [5]
    mitre-attackS1100
    Open source URL
  6. [6]
    mitre-attackS1100
    Open source URL
  7. [7]
    mitre-attackS1100
    Open source URL
  8. [8]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  9. [9]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  10. [10]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  11. [11]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  12. [12]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  13. [13]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  14. [14]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  15. [15]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  16. [16]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  17. [17]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  18. [18]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  19. [19]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  20. [20]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  21. [21]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  22. [22]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  23. [23]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  24. [24]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  25. [25]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  26. [26]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  27. [27]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  28. [28]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  29. [29]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  30. [30]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  31. [31]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  32. [32]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  33. [33]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  34. [34]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  35. [35]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  36. [36]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  37. [37]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  38. [38]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  39. [39]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  40. [40]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  41. [41]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  42. [42]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  43. [43]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  44. [44]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  45. [45]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  46. [46]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  47. [47]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  48. [48]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  49. [49]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  50. [50]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  51. [51]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  52. [52]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  53. [53]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  54. [54]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  55. [55]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  56. [56]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  57. [57]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  58. [58]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  59. [59]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  60. [60]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  61. [61]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  62. [62]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  63. [63]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  64. [64]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  65. [65]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  66. [66]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  67. [67]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  68. [68]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  69. [69]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  70. [70]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  71. [71]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  72. [72]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  73. [73]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  74. [74]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  75. [75]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  76. [76]
    Kaspersky ToddyCat Check Logs October 2023

    Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.

    Open source URL
  77. [77]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  78. [78]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  79. [79]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  80. [80]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  81. [81]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  82. [82]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
  83. [83]
    Kaspersky ToddyCat June 2022

    Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use