Cybersecurity researchers at Kaspersky have uncovered significant new activities of the ToddyCat Advanced Persistent Threat (APT) group, shedding light on the group’s evolving strategies and introducing a fresh set of loaders designed to facilitate its malicious operations. The investigation uncovered a new set of malware used to collect files of interest and exfiltrate them on public and legitimate file hosting services. These findings highlight the increasing adaptability of APT groups to evade detection.
ToddyCat, a sophisticated APT group that first attracted attention in December 2020 due to its high-profile attacks on organizations in Europe and Asia, continues to be a formidable threat. Initially, Kaspersky’s report focused on ToddyCat’s primary tools, the Ninja Trojan and Samurai Backdoor, as well as the loaders used to launch these malicious payloads. Since then, Kaspersky’s experts created special signatures to monitor the actor’s malicious activity. One of the signatures was since detected on a system and the researchers started a new investigation that led to the discovery of ToddyCat’s new tools.
In the past year, Kaspersky researchers have uncovered a new generation of loaders developed by ToddyCat, underscoring the group’s relentless efforts to refine its attack techniques. These loaders play a pivotal role during the infection phase, enabling the deployment of the Ninja Trojan. Intriguingly, ToddyCat occasionally substitutes the standard loaders with a tailored variant, customized for specific target systems. This tailored loader exhibits similar functionality but distinguishes itself with its unique encryption scheme, which takes into account system-specific attributes such as the drive model and volume GUID (globally unique identifier).
To maintain long-term persistence on compromised systems, ToddyCat employs various techniques, including the creation of a registry key and a corresponding service. This ensures that the malicious code is loaded during system startup, a tactic reminiscent of the methods used by the group’s Samurai backdoor.
Kaspersky’s investigation has uncovered additional tools and components used by ToddyCat, including Ninja, a versatile agent with functions like process management, file system control, reverse shell sessions, code injection, and network traffic forwarding. They also employ LoFiSe for finding specific files, DropBox Uploader for data uploads to Dropbox, Pcexter for exfiltrating archive files to OneDrive, a Passive UDP Backdoor for persistence, and CobaltStrike as a loader that communicates with a specific URL, often preceding Ninja deployment. These findings reveal ToddyCat’s extensive toolkit.
These latest findings confirm ToddyCat’s relentless pursuit of espionage-driven objectives, illuminating how the group infiltrates corporate networks, conducts lateral movement, and gathers valuable information. ToddyCat utilizes an array of tactics, encompassing discovery activities, domain enumeration, and lateral movement, all with a singular focus on achieving its espionage goals.
“ToddyCat isn’t just breaking into systems; they’re setting up long-term operations to collect valuable information over an extended period, all while adapting to new conditions to remain undetected,” said Giampaolo Dedola, lead security researcher at GReAT. “Their advanced tactics and adaptability make it clear that this isn’t a hit-and-run. Organizations need to recognize that the threat landscape has evolved; it’s not just about defense anymore, but about ongoing vigilance and adaptability. To stay secure, it’s crucial to invest in top-notch security solutions and have access to the latest findings in threat intelligence.”
For further insights into ToddyCat’s activities, please visit Securelist.com.
