Unveiling ToddyCat: Advanced Cyber Tactics Targeting Governmental Data in the Asia-Pacific Region
Charles M. Walls | April 22, 2024 | Views: 109
The cyber group ToddyCat has been identified for its sophisticated methods of maintaining access and extracting sensitive data from targeted networks. This group predominantly focuses on governmental bodies, some of which are defense-oriented, across the Asia-Pacific region.
A detailed analysis by Russian security experts at Kaspersky reveals that ToddyCat employs a variety of advanced tools to automate the theft of large volumes of data from numerous systems. "In order to efficiently manage the data from multiple sources, attackers have developed methods to automate this process and establish multiple redundant paths to ensure persistent access and control over the attacked systems," explained researchers Andrey Gunkin, Alexander Fedotov, and Natalya Shornikova.
Initially uncovered in June 2022, ToddyCat's activities have been traced back to at least December 2020, targeting government and military installations in Europe and Asia. These attacks commonly use a passive backdoor known as Samurai, which facilitates remote operations on infiltrated systems.
Further investigations into ToddyCat's arsenal uncovered additional tools designed for stealthy data exfiltration. These include LoFiSe and Pcexter, which are used to compile data and upload it via Microsoft OneDrive. The array of tools used by the attackers after gaining initial access includes:
- OpenSSH for reverse SSH tunneling,
- SoftEther VPN camouflaged under names like "boot.exe" and "netscan.exe",
- Ngrok and Krong for encrypting and rerouting command-and-control (C2) traffic,
- A Golang-based reverse proxy called FRP client,
- Cuthead, a .NET tool for searching documents by name or modification date,
- WAExp, another .NET application designed to back up data from the WhatsApp web app, and
- TomBerBil, a tool for extracting credentials and cookies from browsers such as Google Chrome and Microsoft Edge.
These tactics are not just about data theft but also involve sophisticated methods to evade detection and hide their activities within the compromised networks. "Attackers are using advanced techniques to circumvent security measures and conceal their footprints," noted Kaspersky.
To safeguard against such threats, Kaspersky advises organizations to block known malicious IPs and URLs on their firewalls and discourage users from saving passwords in their web browsers, reducing the risk of attackers gaining easy access to sensitive information.
