ToddyCat

ToddyCat is an advanced persistent threat group engaged primarily in cyber-espionage, with activity publicly tracked since at least 2020 and victimology concentrated in organizations across Europe and Asia. The group has been associated with stealth-focused post-compromise tradecraft, long-term persistence, and collection of sensitive enterprise data, including email and document repositories. Aliases include Storm-0247 and Websiic. ToddyCat has demonstrated a strong emphasis on abusing legitimate services and trusted software to evade detection. Reported operations include exploitation of known server-side vulnerabilities for initial access, use of malicious loaders, and repeated reliance on DLL sideloading and proxying to execute payloads through legitimate signed applications. In separate activity, the group used a legitimate media player process to sideload a remote access trojan, and later employed a custom tool known as TCESB to execute payloads from within a security product process while attempting to bypass endpoint protection and monitoring. TCESB has been linked to abuse of a vulnerable driver and kernel-notification tampering, reflecting a mature capability for defense evasion. The group is also notable for cloud- and identity-centric intrusion techniques. ToddyCat developed a technique named Shadow Token via Remote Debug (STRD) to obtain persistent access to Google Workspace resources by abusing OAuth 2.0 delegated authorization from an already compromised endpoint. This technique was implemented with malware known as Umbrij, a .NET tool that enumerates Chromium-based browser profiles, duplicates authenticated profile data, launches a hidden browser instance in remote debugging mode, and automates OAuth consent flows through the DevTools protocol and Puppeteer. By impersonating legitimate Google Workspace synchronization or migration applications and harvesting authorization artifacts, ToddyCat can gain durable API-based access to victim mailboxes and related cloud resources without continued dependence on the compromised host. This tradecraft aligns with broader observations that ToddyCat favors cloud services, OAuth tokens, and legitimate platforms for persistence and collection. Observed host-based behavior attributed to ToddyCat includes PowerShell and command-shell execution, hidden-window script execution, process and security-software discovery, account discovery using domain user enumeration, collection of recently modified office and PDF documents, system and removable-drive information gathering, and manual staging or transfer of collected files. The group has also been linked to theft of Microsoft Outlook email data through a custom tool called TCSectorCopy, further underscoring its focus on communications intelligence. Overall, ToddyCat is characterized by stealthy espionage operations, custom malware development, abuse of trusted binaries and security tooling, and increasing sophistication in cloud account compromise and token-based persistence.