ToddyCatThreat actor
- websiic
ToddyCat is responsible for multiple sets of attacks detected since December 2020 against high-profile entities in Europe and Asia. There is still little information about this actor, but its main distinctive signs are two formerly unknown tools that Kaspersky call ‘Samurai backdoor’ and ‘Ninja Trojan’.From MISP Galaxy
Last reported 2 months ago, by AhnLab ASEC2 reports
ATT&CK techniques
6 of 39 · each with the sentence it comes from- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Encrypted/Encoded File”
- T1027.013Encrypted/Encoded File
“T1027.013”
- T1027.015Compression
“T1027.015”
- T1036Masquerading
“Masquerading: Match Legitimate Name or Location”
- T1036.005Match Legitimate Resource Name or Location
“T1036.005”
- T1053Scheduled Task/Job
“Scheduled Task/Job: Scheduled Task”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Attack Cases for Domestic Web Servers Running SoftEther VPN in Korea“[2] In addition, there are known attack cases where SoftEther VPN was installed by the ToddyCat threat actor, as disclosed by Kaspersky, [3] as well as in the attack process carried out by UNC3500, as disclosed by Mandiant.”
-
LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan“We noticed some overlap in the file paths mentioned in a Kaspersky blogpost about ToddyCat activity, an APT group with similar targeting, but the malware in that report lacks code similarity with the malware considered here.”
Indicators in its reports
named in the reports above- hxxps://login.microsoftonline[.]com/common/oauth2/v2.0/tokenin 1 report
- dev0-411506.iam.gserviceaccount[.]comin 1 report
- hxxps://accounts.google[.]com/o/oauth2/authin 1 report
- hxxps://oauth2.googleapis[.]com/tokenin 1 report
- hxxps://www.googleapis[.]com/oauth2/v1/certsin 1 report
- hxxps://www.googleapis[.]com/robot/v1/metadata/x509/dev0-660%40dev0-411506.iam.gserviceaccount.comin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.