Umbrij Malware Lets ToddyCat Hackers Hijack Gmail Accounts Through Google API Abuse

A targeted campaign in which the ToddyCat (aka APT-style) group leverages a previously observed loader family, Umbrij, to hijack Gmail accounts by abusing Google APIs.

Chaining that capability to broad remote access achieved through a malicious MSI installer masquerading as the Kuailian/LetsVPN client.

The operation blends social engineering with a sophisticated in-memory loader and a feature-rich RAT to establish long-lived access and steal account access without leaving obvious traces on disk.

The initial vector in observed incidents is an MSI named Kuailian_win-setup.86.msi that appears to install LetsVPN, a legitimate VPN used to bypass national firewalls.

Analysis shows the MSI contains three embedded components: a signed LetsVPN installer deployed as a decoy, a shellcode loader (promecefplugilte8.exe), and an encrypted payload stored as 20260609.dat.

Once reflectively loaded, the payload resolves kernel32 APIs by walking the PEB and manually resolving GetProcAddress and LoadLibraryA, then calls the loaded DLL entry with DLL_PROCESS_ATTACH.

C2 selection is driven by an embedded table of 40 server sets, using install_state.ini or the executable filename to pick an InstanceId.

ThreatLocker Threat Intelligence identified an MSI file in-the-wild masquerading as an installer for Kuailian VPN (aka LetsVPN), a service famed for its ability to bypass China’s Great Firewall.

Example hosts include 23[.]133.4.108 and domains such as teddkqoo[.]com and nishihaoren8[.]top (“nishihaoren” = “you are a good person” in Chinese), and operators can change the selection via C2 commands.

The deployed RAT implements a persistent TCP session model rather than simple polling. It creates local identity files ClientId.sys, Mark.sys, Remark.sys, Group.sys stored as plaintext under Program Files, ProgramData, or the runtime directory depending on write permissions.

ToddyCat Hackers Hijack Gmail

Available capabilities include file transfer, an interactive cmd.exe shell, SOCKS5/HTTP proxy mapping, browser profile manipulation, direct input-driven remote control, and keylogging plus clipboard theft.

The loader reserves executable memory via VirtualAlloc, reads the dat blob, decrypts it (simple XOR with 0x25 after a 32-byte key region), and reflectively loads an embedded PE marked by the hex sequence CC DD EE FF. The final payload is never written to disk, minimizing forensic artifacts.

Notably, FeatureType 10 writes keystrokes and clipboard contents to C:\ProgramData\gongzuo.txt and exfiltrates changes, while FeatureType 9/11 target browsers and Telegram Desktop; the latter packages tdata into MeitianGongzuoZiliao.zip and stealthily updates Telegram’s proxy settings, even patching telegram.exe to hide UI notifications of proxy changes.

ToddyCat’s integration of Umbrij with Google API abuse enables account takeover at scale. By leveraging browser manipulation, keylogging, and API token misuse within hijacked sessions, operators can request or mint OAuth tokens and programmatically access Gmail without conventional credential prompts.

The resulting decrypted payload is a reflective loader and loads a valid embedded PE that begins after a hex marker “CC DD EE FF”.

This method reduces reliance on credential dumping and evades many signature-based defenses focused on password theft.

The actors also use system-level persistence via a service (TerminalControlClient) and SYSTEM-scheduled tasks, ensuring pre-login execution.

Operational maturity is evident in C2 resilience (40 server sets), chunked transfer logic for large payloads, and anti-EDR checks that query installed AV/EDR products against 39 strings (including Defender, CrowdStrike, SentinelOne, Huorong, and Qi An Xin).

The reflective, fileless loading model and Telegram proxy hijack illustrate an emphasis on stealth and lateral movement.

Mitigations include restricting unneeded Google API scopes, enforcing MFA with hardware tokens, monitoring OAuth client creation and token issuance, blocking suspicious outbound connections listed in the embedded C2 table, scanning for anomalous CreateThread/VirtualAlloc patterns at process creation time, and validating installer sources before execution.

IOCs

Type	Indicator	Notes
IPv4	23.133.4.108	public IPv4
IPv4	23.133.4.109	public IPv4
IPv4	27.124.40.52	public IPv4
IPv4	27.124.9.47	public IPv4
IPv4	38.45.124.19	public IPv4
IPv4	38.91.114.219	public IPv4
IPv4	154.91.75.192	public IPv4
IPv4 (private)	172.20.10.2	RFC1918 private address
Domain	nishihaoren1.top	suspicious pattern: many numbered nishihaoren*.top/org
Domain	nishihaoren1.org	suspicious pattern
Domain	nishihaoren5.top	suspicious pattern
Domain	nishihaoren5.org	suspicious pattern
Domain	nishihaoren8.top	suspicious pattern
Domain	nishihaoren8.org	suspicious pattern
Domain	nishihaoren16.top	suspicious pattern
Domain	nishihaoren16.org	suspicious pattern
Domain	nishihaoren23.top	suspicious pattern
Domain	nishihaoren23.org	suspicious pattern
Domain	nishihaoren24.top	suspicious pattern
Domain	nishihaoren24.org	suspicious pattern
Domain	nishihaoren36.top	suspicious pattern
Domain	nishihaoren36.org	suspicious pattern
Domain	nishihaoren37.top	suspicious pattern
Domain	nishihaoren37.org	suspicious pattern
Domain	nishihaoren38.top	suspicious pattern
Domain	nishihaoren38.org	suspicious pattern
Domain	nishihaoren39.top	suspicious pattern
Domain	nishihaoren39.org	suspicious pattern
Domain	nishihaoren40.top	suspicious pattern
Domain	nishihaoren40.org	suspicious pattern
Domain	cunmap.cc	suspicious/mapping-sounding name
Domain	shunlifadacaisansanjlb.com	suspicious, long random-looking
Domain	teddkqoo.com	suspicious
Domain	xdsansan.com	suspicious
Domain	teddkwww.com	suspicious
Domain	j6fadacaiaa.com	suspicious
Domain	j6fadacaiai.com	suspicious
Domain	j6llaa.com	suspicious
Domain	j6llaaa.com	suspicious
Domain	j6lluu.com	suspicious
Domain	j6lluuu.com	suspicious
File SHA-256	Kuailian_win-setup.86.msi — 3AD0B2AA1AFE79E95D20AECD1599B524D4D1D5D0972A23D54F778E145EA350C8	flagged as “malicious installer” (per your note)
File SHA-256	promecefplugilte8.exe — 46E2AF62358205AC114C047D878A22258AE448B7BD140FCC5B5F9444D008364F	labeled “shellcode loader”
File SHA-256	dat/20260609.dat — EC3D4D6B0B35E1013C12E0044A8B202D0114809587AA97D83CBAFF68C0E96B81	labeled “shellcode”
File SHA-256	telegram.exe — 4F34E002C9C5916D35C3E32435960E6EF1F8ADFBFE324983F2AAEB09CB8F2D73	labeled “patched Telegram Desktop executable”

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop Accepting SLAs Written for 2019 SOCs – Here’s the 2026 AI SLA Vendor Checklist – Download Free AI SOC SLA Guide