ToddyCat

Targets

Sectors: Government, Defence

Regions: Europe

Known techniques

• T1005Data from Local System
• T1018Remote System Discovery
• T1021.002SMB/Windows Admin Shares
• T1036.005Match Legitimate Resource Name or Location
• T1047Windows Management Instrumentation
• T1049System Network Connections Discovery
• T1053.005Scheduled Task
• T1057Process Discovery
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1069.002Domain Groups
• T1074.002Remote Data Staging
• T1078.002Domain Accounts
• T1083File and Directory Discovery
• T1087.002Domain Account
• T1095Non-Application Layer Protocol
• T1106Native API
• T1190Exploit Public-Facing Application
• T1518.001Security Software Discovery
• T1560.001Archive via Utility
• T1564.003Hidden Window
• T1566.003Spearphishing via Service
• T1567.002Exfiltration to Cloud Storage
• T1680Local Storage Discovery
• T1686Disable or Modify System Firewall

Malware and tools used