THREATOPS Actor Dossier
LIVE ← Dashboard

ToddyCat

G10221 reports
aliases · ToddyCat
Export dossier:
1
Reports
12
Techniques
7
Tactics
0
Countries
46%
Hunt coverage
1
Aliases

Analyst assessment — key judgments

  • Signature techniques: T1053.005 (Scheduled Task), T1059.007 (JavaScript), T1087.002 (Domain Account).
  • Newly emerged: 1 report(s) in last 30d vs 0 prior (+100%).
  • Recent movement: 13 new technique(s), 24 new infrastructure indicator(s) in the last 30 days.
  • Hunt coverage 46% of 13 observed techniques (7 gap(s)).
  • Assessment confidence: medium (60).

Activity & trend

Newly emergedLast 30d: 1 vs 0 prior (+100%)· first reported 2026-06-30 · last 2026-06-30
0
7d
1
30d
1
90d
1
All
0.1
Rpts/wk
Reporting timeline · 12 months

Movement — last 30 days

New techniques
T1053.005T1059.007T1087.002T1586.002T1585.002T1589.002T1136.002T1134.003T1087.004T1059.001T1136.003T1589.001
New infrastructure
1ab58838e5790efb22f2d35ab98c0b7da7d7d6c4c3f227f7117261c63b9e23a93d3a621f852c42d97fd7260681e425083432dd9ac0df80ef86eb80bd080f839b22aaeb4946ba6d2f2e27feb7dbb295def61fbfb7aa1cd5dc8f70b055b51563e2f169d6d172dfb775895a5e2b1540c8549f5f2f0fb0a7f5aa9f16b9a7b6dad89f28cb7b261f4eb97e8a4b3b0d32f8def1bae82a15d1dbfb024617b9b56a8e5f66https://chromeenterprise.google/policieshttps://www.kaspersky.com/next?icid=gl_s

Overview

Analyst triage
Intelligence summary

ToddyCat is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kaspersky ToddyCat Check Logs October 2023)

Top co-occurring indicators
    Aliases & naming
      Targeting · countries
        Targeting · named victims

          ATT&CK technique matrix

          Coverage vs hunt library:
          Hunt-coverage gaps — prioritized

            Top techniques by observation

            Threat catalogue · engineering roadmap0

            Flagged detection-engineering queue

            Uncovered techniques you flagged for hunt / detection build-out, aggregated across every actor you visit. Stored locally in your browser.

              No techniques queued yet — flag a gap above to add it here.

              Infrastructure

              IOC type mix
              Tooling / malware families
                Tracked infrastructure

                Relationships

                Related actors (behavioral cluster)
                  Attributed malware
                  Campaigns
                  No behavioral cluster, attributed malware, or campaigns recorded for this actor yet.

                  Activity

                  30-day mention timeline
                  Recent reporting
                  TitleSourceSeverityCollected