ToddyCat, a highly skilled advanced persistent threat (APT) actor notorious for launching targeted attacks in Europe and Asia, has recently upgraded its arsenal of tools and methods, signifying an evolution in its modus operandi.
Recent findings from the cybersecurity researchers at SecureList by Kaspersky provide insights into their:-
- New toolset
- Data theft malware
- Lateral movement techniques
- Espionage operations
Researchers affirmed that the hackers behind the ToddyCat APT group are actively exploiting the vulnerable Microsoft Exchange servers.
Tools Used By Attackers
Here below, we have mentioned all the tools that the threat actors behind the ToddyCat APT group use:-
- Standard loaders
- Tailored loader
- Ninja
- LoFiSe
- DropBox uploader
- Pcexter
- Passive UDP backdoor
- CobaltStrike
ToddyCat APT Exploiting Exchange Servers
ToddyCat conducts espionage by infiltrating networks with loaders and Trojans. After gaining access, they collect data about connected hosts and perform discovery activities, enumerating domain accounts and servers using standard OS utilities like net and ping:-
net group "domain admins" /dom
net user %USER% /dom
net group "domain computers" /dom | findstr %VALUABLE_USER%
ping %REMOTE_HOST% -4
Attackers regularly change credentials and employ scripts in a scheduled task that runs briefly and is removed, along with network shares, for each targeted host.
Scheduled tasks may include discovery commands or scripts for data collection. The attacker can access the Output from these tasks by mounting a remote drive as a local share during lateral movement.
PowerShell commands from the PS1 script were duplicated in a BAT script to evade detection.
To avoid suspicion, the group consistently employs common task names like ‘one’ and ‘tpcd’ for a session. Script names are random keyboard-walking characters. They mount and delete a temporary share on the exfiltration host at the end of their activity.
The threat actor gathers files from various hosts, archives them, and exfiltrates them via public storage.
LoFiSe, designed for file collection, is complemented by other scripts for enumerating and collecting recently modified documents with specific extensions.
Besides this, the script variants for data collection didn’t use compressed archives. Files were copied to specific folders, transferred manually to the exfiltration host via xcopy, and then compressed with 7z.
IOCs
Loaders 97D0A47B595A20A3944919863A8163D1 Variant “Update” 828F8B599A1CC4A02A2C3928EC3F5F8B Variant “VLC” A 90B14807734045F1E0A47C40DF949AC4 Variant “VLC” B 0F7002AACA8C1E71959C3EE635A85F14 Tailored loader D3050B3C7EE8A80D8D6700624626266D Tailored loader D4D8131ED03B71D58B1BA348F9606DF7 Tailored loader Passive UDP backdoors 65AF75986577FCC14FBC5F98EFB3B47E Dropbox exfiltrator BEBBEBA37667453003D2372103C45BBF LoFiSe 14FF83A500D403A5ED990ED86296CCC7 4AD609DDDF2C39CDA7BDBE2F9DC279FD Pcexter D0CD88352638F1AE101C2A13356AB6B7 318C16195F62094DADCC602B547BBE66 Dropper C170F05333041C56BCC39056FECB808F
Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Take advantage of the free trial to ensure 100% security.
