THREAT OPS › Threat News › ToddyCat: your hidden email assistant. Part 2
ToddyCat: your hidden email assistant. Part 2
<p><img alt="" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/06/19083452/toddycat-part-2-featured-image-990x400.jpg" width="990" /></p><h2 id="introduction">Introduction</h2> <p>We continue to share details on the malicious techniques and toolsets used by the ToddyCat APT gr
Attributed threat actors
- Earth LuscaG1006
- ToddyCatG1022
MITRE ATT&CK techniques
- Scheduled TaskT1053.005
- JavaScriptT1059.007
- Domain AccountT1087.002
- Email AccountsT1586.002
- Email AccountsT1585.002
- Email AddressesT1589.002
- Domain AccountT1136.002
- Make and Impersonate TokenT1134.003
- Cloud AccountT1087.004
- PowerShellT1059.001
- Cloud AccountT1136.003
- CredentialsT1589.001
- Access Token ManipulationT1134
Indicators of compromise
- 1ab58838e5790efb22f2d35ab98c0b7dmd5
- a7d7d6c4c3f227f7117261c63b9e23a9md5
- 3d3a621f852c42d97fd7260681e42508md5
- 3432dd9ac0df80ef86eb80bd080f839bmd5
- 22aaeb4946ba6d2f2e27feb7dbb295demd5
- f61fbfb7aa1cd5dc8f70b055b51563e2md5
- f169d6d172dfb775895a5e2b1540c854md5
- 9f5f2f0fb0a7f5aa9f16b9a7b6dad89fmd5
- 28cb7b261f4eb97e8a4b3b0d32f8def1md5
- bae82a15d1dbfb024617b9b56a8e5f66md5
- https://chromeenterprise.google/policies/?policy=DeveloperToolsAvailabilityurl
- https://www.kaspersky.com/next?icid=gl_sl_knext-post_sm-team_cede4e5dff54f34aurl
- https://www.kaspersky.com/enterprise-security/threat-intelligence-reporting?icid=gl_sl_post-link-tip-reports_sm-team_54d4bf9ad05581e5url
- https://opentip.kaspersky.com/1ab58838e5790efb22f2d35ab98c0b7d/results?icid=gl_sl_post-opentip_sm-team_55c6d627f6cb1064&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/a7d7d6c4c3f227f7117261c63b9e23a9/results?icid=gl_sl_post-opentip_sm-team_7776aacc6bc37f7c&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/3d3a621f852c42d97fd7260681e42508/results?icid=gl_sl_post-opentip_sm-team_b038d67f399f6530&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/3432dd9ac0df80ef86eb80bd080f839b/results?icid=gl_sl_post-opentip_sm-team_675b6137d36b2566&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/22aaeb4946ba6d2f2e27feb7dbb295de/results?icid=gl_sl_post-opentip_sm-team_591974aaf1215dca&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/f61fbfb7aa1cd5dc8f70b055b51563e2/results?icid=gl_sl_post-opentip_sm-team_5c9365dec6468c16&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/f169d6d172dfb775895a5e2b1540c854/results?icid=gl_sl_post-opentip_sm-team_2513ad63bae44626&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- intelreports@kaspersky.comemail
- media.kasperskycontenthub.comdomain
- 279448736670.apps.googleusercontent.comdomain
- gmail.comdomain
Original source: https://securelist.com/toddycat-apt-umbrij-tool-and-oauth/120251/