ToddyCat
ToddyCat is a threat actor also referred to in the provided content as Storm-0247 and Websiic. The content links Websiic to targeting unpatched Microsoft Exchange servers via ProxyLogon, including seven email servers belonging to private companies in the IT, telecommunications, and engineering sectors in Asia and a governmental body in Eastern Europe. Observed ToddyCat tradecraft in the provided content includes exploitation of public-facing applications, use of web shells and IIS components for persistence, execution via Windows command shell, batch scripts, PowerShell, and WMI, and use of scheduled tasks to run discovery commands and collection scripts. The actor has been observed running cmd /c start /b tasklist to enumerate processes, using ping %REMOTE_HOST% for post-exploitation discovery, collecting documents from targeted hosts with scripts, and manually transferring collected files to an exfiltration host with xcopy. The content also states that ToddyCat used a Dropbox uploader to exfiltrate stolen files and used the name debug.exe for malware components.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
48 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
19 malware families attributed to this actor across reporting.
14 additional families tracked in Mallory.
Associated vulnerabilities
12 CVEs this actor has used in observed campaigns. 12 of them exploited in the wild.
APT41 leveraged vulnerabilities such as ProxyLogon exploitation... APT41 exploited CVE-2021-26855 against a vulnerable Microsoft Exchange Server... Threat Group-3390 ... exploited ... CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server. ToddyCat has exploited the ProxyLogon vulnerability (CVE-2021-26855)...
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
Previously, Eset reported that about five APT groups has been exploiting the four Exchange vulnerabilities - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065
Previously, Eset reported that about five APT groups has been exploiting the four Exchange vulnerabilities - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065
Previously, Eset reported that about five APT groups has been exploiting the four Exchange vulnerabilities - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065
7 more CVEs tied to this actor tracked in Mallory.
Observables
36 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as a threat actor associated with the PowerShell P/Invoke process injection API chain detection and related ATT&CK techniques.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection analytic.
Listed as a threat actor associated with use of Cobalt Strike PowerShell loader patterns.
Associated with exfiltration to cloud storage, specifically the use of Azure Storage utilities such as AzCopy or Storage Explorer for staging or extracting sensitive data over trusted cloud channels.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.