CVE Intelligence
Home / Threat actors / ToddyCat

ToddyCat G1022

🔔 Create alert

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

1
associated CVEs
30
Techniques
9
Malware and tools

ToddyCat is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2021-26855 Critical · 9.1 KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability
“ToddyCat has exploited the ProxyLogon vulnerability (CVE-2021-26855) to compromise Exchange Servers at multiple organizations.”

Techniques by tactic

Initial Access
T1078.002 Domain AccountsT1190 Exploit Public-Facing ApplicationT1566.003 Spearphishing via Service
Execution
T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1106 Native API
Persistence
T1053.005 Scheduled TaskT1078.002 Domain Accounts
Privilege Escalation
T1053.005 Scheduled TaskT1078.002 Domain Accounts
Stealth
T1036.005 Match Legitimate Resource Name or LocationT1078.002 Domain AccountsT1564.003 Hidden Window
Defense Impairment
T1686 Disable or Modify System Firewall
Discovery
T1018 Remote System DiscoveryT1049 System Network Connections DiscoveryT1057 Process DiscoveryT1069.002 Domain GroupsT1083 File and Directory DiscoveryT1087.002 Domain AccountT1518.001 Security Software DiscoveryT1680 Local Storage Discovery
Lateral Movement
T1021.002 SMB/Windows Admin Shares
Collection
T1005 Data from Local SystemT1074.002 Remote Data StagingT1560.001 Archive via Utility
Command and Control
T1095 Non-Application Layer Protocol
Exfiltration
T1567.002 Exfiltration to Cloud Storage

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.