Researchers Unveil ToddyCat’s New Set of Tools for Data Exfiltration

The advanced persistent threat (APT) actor recognized as ToddyCat has been linked to a new established of destructive equipment that are made for info exfiltration, presenting a further perception into the hacking crew’s tactics and abilities.

The conclusions occur from Kaspersky, which 1st lose gentle on the adversary very last yr, linking it to attacks versus substantial-profile entities in Europe and Asia for practically 3 years.

Although the group’s arsenal prominently attributes Ninja Trojan and a backdoor called Samurai, further more investigation has uncovered a complete new established of destructive software package produced and managed by the actor to attain persistence, carry out file functions, and load extra payloads at runtime.

This includes a selection of loaders that comes with abilities to start the Ninja Trojan as a 2nd phase, a software named LoFiSe to obtain and accumulate data files of interest, a DropBox uploader to help you save stolen details to Dropbox, and Pcexter to exfiltrate archive data files to Microsoft OneDrive.

ToddyCat has also been noticed using tailor made scripts for facts assortment, a passive backdoor that receives commands with UDP packets, Cobalt Strike for post-exploitation, and compromised area admin qualifications to aid lateral motion to go after its espionage routines.

“We observed script variants made entirely to obtain info and copy files to precise folders, but with no such as them in compressed archives,” Kaspersky mentioned.

“In these instances, the actor executed the script on the distant host applying the standard remote activity execution system. The collected documents were then manually transferred to the exfiltration host using the xcopy utility and last but not least compressed applying the 7z binary.”

The disclosure will come as Look at Place uncovered that authorities and telecom entities in Asia have been targeted as part of an ongoing campaign since 2021 making use of a large range of “disposable” malware to evade detection and provide upcoming-stage malware.

The exercise, for each the cybersecurity organization, relies on infrastructure that overlaps with that applied by ToddyCat.

Observed this post attention-grabbing? Abide by us on Twitter  and LinkedIn to examine extra special content material we submit.

Some parts of this article are sourced from:
thehackernews.com