ToddyCat
G10221 reportsaliases · ToddyCat
1
Reports
12
Techniques
7
Tactics
0
Countries
46%
Hunt coverage
1
Aliases
Analyst assessment — key judgments
- Signature techniques: T1053.005 (Scheduled Task), T1059.007 (JavaScript), T1087.002 (Domain Account).
- Newly emerged: 1 report(s) in last 30d vs 0 prior (+100%).
- Recent movement: 13 new technique(s), 24 new infrastructure indicator(s) in the last 30 days.
- Hunt coverage 46% of 13 observed techniques (7 gap(s)).
- Assessment confidence: medium (60).
Activity & trend
Newly emergedLast 30d: 1 vs 0 prior (+100%)· first reported 2026-06-30 · last 2026-06-30
0
7d
1
30d
1
90d
1
All
0.1
Rpts/wk
Reporting timeline · 12 months
Movement — last 30 days
New techniques
T1053.005T1059.007T1087.002T1586.002T1585.002T1589.002T1136.002T1134.003T1087.004T1059.001T1136.003T1589.001New infrastructure
1ab58838e5790efb22f2d35ab98c0b7da7d7d6c4c3f227f7117261c63b9e23a93d3a621f852c42d97fd7260681e425083432dd9ac0df80ef86eb80bd080f839b22aaeb4946ba6d2f2e27feb7dbb295def61fbfb7aa1cd5dc8f70b055b51563e2f169d6d172dfb775895a5e2b1540c8549f5f2f0fb0a7f5aa9f16b9a7b6dad89f28cb7b261f4eb97e8a4b3b0d32f8def1bae82a15d1dbfb024617b9b56a8e5f66https://chromeenterprise.google/policieshttps://www.kaspersky.com/next?icid=gl_sOverview
Analyst triage
Intelligence summary
ToddyCat is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kaspersky ToddyCat Check Logs October 2023)
Top co-occurring indicators
Aliases & naming
Targeting · countries
Targeting · named victims
ATT&CK technique matrix
Coverage vs hunt library:
—
Hunt-coverage gaps — prioritized
Top techniques by observation
- T1053.005 · Scheduled Taskconf 601
- T1059.007 · JavaScriptconf 601
- T1087.002 · Domain Accountconf 601
- T1586.002 · Email Accountsconf 601
- T1585.002 · Email Accountsconf 601
- T1589.002 · Email Addressesconf 601
- T1136.002 · Domain Accountconf 601
- T1134.003 · Make and Impersonate Tokenconf 601
- T1087.004 · Cloud Accountconf 601
- T1059.001 · PowerShellconf 601
- T1136.003 · Cloud Accountconf 601
- T1589.001 · Credentialsconf 601
Threat catalogue · engineering roadmap
Flagged detection-engineering queue
Uncovered techniques you flagged for hunt / detection build-out, aggregated across every actor you visit. Stored locally in your browser.
Infrastructure
IOC type mix
Tooling / malware families
Relationships
Activity
30-day mention timeline
Recent reporting
| Title | Source | Severity | Collected |
|---|