ToddyCat is responsible for multiple sets of attacks detected since December 2020 against high-profile entities in Europe and Asia. There is still little information about this actor, but its main distinctive signs are two formerly unknown tools that Kaspersky call ‘Samurai backdoor’ and ‘Ninja Trojan’.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | Websiic |
Sectors: Military, Government
Victim countries: Afghanistan, India, Indonesia, Iran, Kyrgyzstan, Malaysia, Pakistan, Russia, Slovakia, Taiwan, Thailand, United Kingdom, Uzbekistan, Vietnam
Top 34 by how many reports mention them.
Every report in the Global Intel Library that names ToddyCat, newest first. Open any report to see the full analysis with provenance.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to ToddyCat. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.