Loading story…
ToddyCat is a sophisticated cyber espionage group that has targeted high-profile organizations across Europe and Asia since 2020, initially compromising Microsoft Exchange servers in Taiwan and Vietnam using an unidentified vulnerability. The group rapidly expanded its operations in early 2021 by exploiting the ProxyLogon vulnerability, enabling them to move beyond regional targets and establish a global presence. Their campaigns involve deploying multiple malware variants, such as China Chopper web shells, Samurai backdoors, and Ninja Trojan loaders, with later operations introducing advanced tools like TCESB to exploit security products and PowerShell-based credential harvesting scripts. ToddyCat demonstrates a deep understanding of Windows security architecture, employing scheduled tasks, PowerShell commands with bypass flags, and sophisticated defense evasion techniques including BYOVD, DLL side-loading, and reverse SSH tunnels to maintain persistence and avoid detection.
The group’s lateral movement is facilitated through SMB shares, and they use specialized tools like TCSectorCopy to bypass file locks and extract sensitive data, which is then compressed and exfiltrated over command-and-control channels. Their evolving toolkit and operational security measures highlight a continuous adaptation to security defenses, making them a persistent threat to organizations worldwide. Security analysts have mapped ToddyCat’s tactics, techniques, and procedures to MITRE ATT&CK, providing defenders with actionable intelligence to simulate and mitigate these advanced threats.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
By early January 2026, public reporting described ToddyCat as using advanced persistence, defense evasion, credential theft, and data exfiltration techniques, including scheduled tasks, PowerShell policy bypass, browser memory dumping, OAuth token theft, and encrypted exfiltration. Reporting also highlighted newer tooling such as the TCESB utility targeting security product vulnerabilities.
After its initial activity, ToddyCat broadened operations by exploiting the Microsoft Exchange ProxyLogon vulnerability against organizations across Europe and Asia. The campaign used tools including China Chopper web shells, the Samurai backdoor, and Ninja Trojan loaders to establish access and persistence.
ToddyCat activity was observed starting in December 2020, initially compromising Microsoft Exchange servers at high-profile organizations in Taiwan and Vietnam. These early intrusions marked the beginning of the group's known cyber-espionage campaign.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The ToddyCat advanced persistent threat (APT) group has evolved its attack methods, shifting focus from browser credential theft to targeting Outlook email archives and Microsoft 365 access tokens. Recent research by Kaspersky highlights the use of new custom tools, such as TCSectorCopy and updated versions of TomBerBil, which enable the group to extract entire email archives and OAuth 2.0 tokens from compromised corporate environments. These tokens can be used to access corporate mail outside the victim's infrastructure, increasing the risk of data exfiltration and unauthorized access. The updated TomBerBil toolkit, now observed running as a PowerShell variant on domain controllers with privileged access, leverages scheduled tasks and the SMB protocol to collect browser data—including cookies, saved credentials, and history—from remote hosts. By capturing Windows DPAPI encryption keys, ToddyCat can decrypt sensitive information for offline analysis. The group has also exploited vulnerabilities such as CVE-2024-11859 in ESET Command Line Scanner to deliver new malware, further expanding its capabilities to target organizations across Europe and Asia.
Jun 29, 2026
Trend Micro and TrendAI reported that **Earth Estries**, a China-linked espionage group active since at least 2020, compromised more than 20 organizations across the United States, Asia-Pacific, the Middle East, South Africa, and Southeast Asia. The intrusions primarily targeted **government, telecommunications, and technology-sector organizations**, with researchers linking the activity to prolonged campaigns against telecom providers and government networks. The group has been associated with overlaps in tradecraft and tooling seen in **FamousSparrow** and other Chinese APT activity, though researchers said some malware and infrastructure may reflect shared ecosystem resources rather than exclusive ownership. Researchers said Earth Estries gained initial access by exploiting public-facing systems, including **Ivanti Connect Secure**, **Fortinet FortiClient EMS** SQL injection flaws, **Sophos Firewall** code injection bugs, and the **Microsoft Exchange ProxyLogon** chain. After breaching servers and administrative accounts, the actors used **PowerShell downgrade attacks**, **DLL sideloading**, **living-off-the-land binaries**, **Cobalt Strike**, **SMB**, and **WMIC** for persistence and lateral movement, while deploying backdoors and implants such as **Zingdoor**, **HemiGate**, **TrillClient**, **GHOSTSPIDER**, **SNAPPYBEE**, **DEMODEX**, and **MASOL RAT**. Stolen documents and browser data were exfiltrated through public file-sharing services and SMTP, and the operators masked command-and-control traffic with techniques including **Fastly CDN** fronting and infrastructure patterns consistent with DNS tunneling.
Aug 21, 2026
State-backed advanced persistent threat (APT) groups have intensified their cyber espionage activities, employing increasingly sophisticated tactics, techniques, and procedures (TTPs) to infiltrate and persist within high-value targets. APT15, believed to operate out of China, has conducted a series of high-profile campaigns targeting government entities, defense contractors, and minority groups across Europe, North America, and Asia. Their operations leverage spear phishing, exploitation of public-facing applications, and advanced defense evasion methods such as steganography and masquerading malware as legitimate software. Similarly, the Iranian group Charming Kitten (APT35) has been exposed through recent leaks, revealing the identities of key personnel, financial structures, and thousands of compromised systems worldwide. These leaks detail how the group uses spear-phishing, fake login pages, and malicious attachments to gain initial access, followed by persistent surveillance and data exfiltration from government, academic, and civil society networks. Technical analysis of these groups' operations highlights the use of legitimate system tools for lateral movement and persistence, as well as complex command-and-control (C2) infrastructures designed to evade detection. The leaks concerning Charming Kitten provide unprecedented insight into the operational management and financial underpinnings of Iranian cyber espionage, including the use of front companies and detailed tasking sheets. Both APT15 and APT35 demonstrate the ongoing evolution of state-sponsored cyber threats, with a focus on stealth, persistence, and the targeting of sensitive information across multiple sectors and geographies.
Jun 29, 2026