Russian Hacker Group ToddyCat Uses Advanced Tools for Industrial-Scale Data Theft

The menace actor recognized as ToddyCat has been noticed applying a extensive array of equipment to retain access to compromised environments and steal precious details.

Russian cybersecurity company Kaspersky characterised the adversary as relying on several systems to harvest information on an “industrial scale” from generally governmental organizations, some of them protection associated, found in the Asia-Pacific location.

“To collect significant volumes of info from a lot of hosts, attackers need to have to automate the facts harvesting procedure as a great deal as probable, and give various option signifies to repeatedly accessibility and keep track of systems they attack,” security researchers Andrey Gunkin, Alexander Fedotov, and Natalya Shornikova explained.

ToddyCat was initially documented by the firm in June 2022 in link with a series of cyber attacks aimed at governing administration and army entities in Europe and Asia since at least December 2020. These intrusions leveraged a passive backdoor dubbed Samurai that enables for remote obtain to the compromised host.

A closer examination of the threat actor’s tradecraft has because uncovered supplemental facts exfiltration equipment like LoFiSe and Pcexter to obtain knowledge and add archive files to Microsoft OneDrive.

The most current set of plans entail a mix of tunneling facts accumulating computer software, which are set to use right after the attacker has previously attained access to privileged consumer accounts in the contaminated process. This incorporates –

• Reverse SSH tunnel applying OpenSSH

• SoftEther VPN, which is renamed to seemingly innocuous information like “boot.exe,” “mstime.exe,” “netscan.exe,” and “kaspersky.exe”

• Ngrok and Krong to encrypt and redirect command-and-command (C2) site visitors to a sure port on the concentrate on method

• FRP client, an open up-source Golang-based quick reverse proxy

• Cuthead, a .NET compiled executable to look for for paperwork matching a certain extension or a filename, or the date when they are modified

• WAExp, a .NET system to capture knowledge related with the WhatsApp web application and save it as an archive, and

• TomBerBil to extract cookies and credentials from web browsers like Google Chrome and Microsoft Edge

“The attackers are actively utilizing tactics to bypass defenses in an attempt to mask their existence in the process,” Kaspersky explained.

“To protect the organization’s infrastructure, we advocate including to the firewall denylist the resources and IP addresses of cloud solutions that supply site visitors tunneling. In addition, customers will have to be required to avoid storing passwords in their browsers, as it will help attackers to entry sensitive details.”

Observed this report intriguing? Adhere to us on Twitter  and LinkedIn to go through more exceptional information we submit.

Some parts of this article are sourced from:
thehackernews.com