Threat Actor Characterization
ToddyCat
ID: 4efdbedc4258546a01f44fb762b1b32490944Actor Network Graph
Open Network GraphMITRE ATT&CK®
ToddyCat (G1022) — espionage actor active since 2020 that compromised Microsoft Exchange servers to stage a multistage chain using China Chopper web shells, a .NET Samurai backdoor with HTTPListener C2, and a Ninja post-exploitation toolkit enabling proxy-based pivoting and large-scale data theft across government/military/telecom targets in Asia and Europe.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | TA0001 |
|
| T1505.003 | Web Shell | TA0003 |
|
| T1105 | Ingress Tool Transfer | TA0011 |
|
| T1059.003 | Windows Command Shell | TA0002 |
|
| T1090 | Proxy | TA0011 |
|
| T1071.001 | Web Protocols | TA0011 |
|
| T1041 | Exfiltration Over C2 Channel | TA0010 |
|
CLASSIFICATION: Unclassified / Open Source
Executive Summary
ToddyCat is a sophisticated espionage actor active since late 2020, targeting government, military, and telecommunications entities across Asia and Europe. The group’s hallmark is a multistage chain that initially compromised Microsoft Exchange servers (first with an unknown exploit, then rapidly via ProxyLogon), deploying the China Chopper web shell and staging a custom Samurai backdoor and Ninja post-exploitation toolkit. Samurai uses .NET HTTPListener to receive crafted POSTs containing encrypted C# snippets compiled at runtime; Ninja enables collaborative, deep post-exploitation (pivoting, lateral control, and traffic camouflage). Campaigns and tooling were first documented in depth by Kaspersky (2022) and later updates; MITRE formalized the cluster as G1022 in 2024. Capability: medium-high; OPSEC: mature; Confidence: high (multi-source).
Public sources do not firmly attribute ToddyCat to a specific state; vendors describe it as a previously unknown APT with bespoke tooling and sustained focus on state-linked targets. INFERENCE: targeting and cadence are consistent with state-aligned intelligence collection (confidence: medium).