Researchers Unveil ToddyCat’s New Set of Tools for Data Exfiltration

The innovative persistent danger (APT) actor identified as ToddyCat has been linked to a new established of malicious applications that are built for info exfiltration, giving a further perception into the hacking crew’s practices and abilities.

The results occur from Kaspersky, which to start with lose mild on the adversary very last year, linking it to attacks versus large-profile entities in Europe and Asia for almost three several years.

Even though the group’s arsenal prominently features Ninja Trojan and a backdoor identified as Samurai, further investigation has uncovered a entire new set of malicious application created and preserved by the actor to obtain persistence, conduct file functions, and load supplemental payloads at runtime.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

This comprises a collection of loaders that will come with capabilities to start the Ninja Trojan as a 2nd stage, a instrument named LoFiSe to come across and gather information of desire, a DropBox uploader to help you save stolen data to Dropbox, and Pcexter to exfiltrate archive data files to Microsoft OneDrive.

ToddyCat has also been observed employing customized scripts for details assortment, a passive backdoor that receives instructions with UDP packets, Cobalt Strike for write-up-exploitation, and compromised domain admin credentials to aid lateral movement to go after its espionage functions.

“We noticed script variants designed only to obtain details and duplicate files to particular folders, but with no like them in compressed archives,” Kaspersky claimed.

“In these instances, the actor executed the script on the distant host utilizing the conventional remote undertaking execution technique. The gathered documents were then manually transferred to the exfiltration host making use of the xcopy utility and ultimately compressed employing the 7z binary.”

The disclosure comes as Examine Issue uncovered that govt and telecom entities in Asia have been qualified as part of an ongoing campaign due to the fact 2021 working with a broad selection of “disposable” malware to evade detection and deliver upcoming-phase malware.

The exercise, for every the cybersecurity agency, relies on infrastructure that overlaps with that employed by ToddyCat.

Identified this post exciting? Abide by us on Twitter  and LinkedIn to read extra exceptional written content we post.