Início / Grupos de ameaça / ToddyCat
ToddyCat G1022
Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK
1
CVEs associadas
30
Técnicas
9
Malwares e ferramentas
ToddyCat is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia.
Vulnerabilidades exploradas
CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.
CVE-2021-26855
Crítica · 9.1
KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability
“ToddyCat has exploited the ProxyLogon vulnerability (CVE-2021-26855) to compromise Exchange Servers at multiple organizations.”
Técnicas por tática
Acesso inicial
T1078.002 Domain AccountsT1190 Exploit Public-Facing ApplicationT1566.003 Spearphishing via Service Execução
T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1106 Native API Persistência
T1053.005 Scheduled TaskT1078.002 Domain Accounts Escalada de privilégios
T1053.005 Scheduled TaskT1078.002 Domain Accounts Furtividade
T1036.005 Match Legitimate Resource Name or LocationT1078.002 Domain AccountsT1564.003 Hidden Window Comprometimento de defesas
T1686 Disable or Modify System Firewall Descoberta
T1018 Remote System DiscoveryT1049 System Network Connections DiscoveryT1057 Process DiscoveryT1069.002 Domain GroupsT1083 File and Directory DiscoveryT1087.002 Domain AccountT1518.001 Security Software DiscoveryT1680 Local Storage Discovery Movimento lateral
T1021.002 SMB/Windows Admin Shares Coleta
T1005 Data from Local SystemT1074.002 Remote Data StagingT1560.001 Archive via Utility Comando e controle
T1095 Non-Application Layer Protocol Exfiltração
T1567.002 Exfiltration to Cloud Storage Malwares e ferramentas
- China ChopperMalwareS0020
- Cobalt StrikeMalwareS0154
- LoFiSeMalwareS1101
- NinjaMalwareS1100
- PcexterMalwareS1102
- SamuraiMalwareS1099
- NetFerramentaS0039
- netstatFerramentaS0104
- PingFerramentaS0097
© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.