Loading threat actor…
ToddyCat, also tracked as Storm-0247 and Websiic, is a Chinese-affiliated cyberespionage actor active since at least 2020. It targets organizations in Europe and Asia, including government bodies and private-sector information technology, telecommunications, and engineering companies. Its operations emphasize concealed access to corporate correspondence and the theft of sensitive information. Activity tracked as Websiic included exploitation of Microsoft Exchange servers before the release of ProxyLogon patches. ToddyCat combines custom malware, publicly available utilities, and legitimate administration tools. Its email-collection toolkit includes TCSectorCopy, which reads disk sectors to copy Outlook offline mail stores; TomBerBil variants that collect browser data and Windows Data Protection API keys; and SharpTokenFinder, which extracts Microsoft 365 authentication tokens from memory. Stolen OAuth tokens enable access to corporate email from outside compromised infrastructure. When security software blocks token extraction, the actor has used Sysinternals ProcDump to obtain Outlook process-memory dumps. It has also exploited CVE-2024-11859 in ESET Command Line Scanner to deploy TCESB through DLL side-loading. Additional tradecraft includes SMB-based lateral tool transfer, PowerShell payload delivery, hidden script execution, security-software discovery, HTTPS command and control, SoftEther VPN deployment, and exfiltration of archived data to Dropbox. Infrastructure overlaps with the Stayin’ Alive campaign and tooling overlaps with Earth Kurma do not establish either as a ToddyCat subgroup.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
109 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
30 malware families Mallory has associated with this actor across public reporting.
25 additional families tracked in Mallory.
16 CVEs Mallory has associated with this actor across public reporting. 16 of them are exploited in the wild (not necessarily by this actor).
10 more CVEs tied to this actor tracked in Mallory.
135 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.