Loading malware…
TCSectorCopy is a custom C++ information-stealing utility used by the ToddyCat threat actor to collect corporate email data from compromised Windows systems. It targets Microsoft Outlook Offline Storage Table (OST) files, which contain locally cached mailbox data.
The utility opens the disk as a read-only device and copies OST files sector by sector, bypassing file-lock restrictions that prevent ordinary copying while Outlook is running. The copied archives can subsequently be processed with tools such as XstReader to extract email correspondence. TCSectorCopy serves as a post-exploitation collection component in ToddyCat’s corporate email espionage operations.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
TCSectorCopy (xCopy.exe), a C++ tool, accesses corporate emails in local Microsoft Outlook OST files by reading disk sectors.
1 distinct technique documented for this family, organized by ATT&CK tactic.
"attempt to gain access to corporate correspondence files in the local Outlook storage... attackers created a specialized tool called TCSectorCopy."
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.