Skip to content

ToddyCat

IntrusionSet · ATTACK:enterprise:G1022

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:G1022",
  "title": "ToddyCat",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G1022",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--b516b235-fc7d-4635-aca5-3d33312339c3",
  "external_id": "G1022",
  "domain": "enterprise",
  "created": "2024-01-03T21:34:10.988Z",
  "modified": "2026-07-31T18:48:13.519Z",
  "version": "1.0",
  "aliases": [
    "ToddyCat"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Kaspersky ToddyCat June 2022",
      "url": "https://securelist.com/toddycat/106799/"
    },
    {
      "source_name": "Kaspersky ToddyCat Check Logs October 2023",
      "url": "https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"
    }
  ]
}

Explicit source assertions (34)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07442853-5df4-425b-98cb-be22df646b43

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2095d4fa-73b6-4a67-ac25-394f64d122d5

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1069.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--333f527e-15e1-4760-a03b-c1ca4edc351b

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ec64efd-1ee8-4bfd-8ff1-3316806d7979

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56f08580-ffab-4c02-8702-adbe4de12a6a

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1566.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--586d0572-cf64-4cc3-93a3-4ee11b49e9cd

Kaspersky ToddyCat June 2022

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:S1101

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5beb3695-1e17-401d-84d3-7f007ac50bff

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63cda638-c359-470f-b509-446be108b607

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6fabc88f-9582-4658-807c-7ec583edbd5e

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1078.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6fb67c72-b963-415f-a0fc-dbd34c3442f2

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7826256e-62c5-4580-80f0-3dae2916f4bd

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:S0020

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85932e53-5211-4998-a497-955254c1281c

Kaspersky ToddyCat June 2022

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:S0104

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b55c302-7e18-4727-a27d-6e4f0b3cecd6

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d5b3c01-b260-4212-a4f0-f061c3c701cf

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e24b237-b2a1-4d48-ae32-fd0b2d345a74

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9246e480-a0ee-4e5d-9d4b-a0f7adb34d85

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96705ab7-dfd9-4360-a0bb-e434bd194697

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a247d3fe-a150-4096-a6e1-1d150e3e407d

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1190

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2a5e505-b957-430e-9bbd-75e6d9e34532

Kaspersky ToddyCat June 2022

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7eecdbc-2e80-4c36-bbde-dbba10b60f70

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac0fcc8b-d546-4882-bb25-f12a8b9381ee

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2ff2217-ef23-4348-b8de-04e9aa195714

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b41c3406-5ffb-4e92-ab0a-bc62da337eb9

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1564.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b682bc04-73f7-4597-a772-264b28468fed

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bad38b14-93b7-42a3-b0a3-6170aa895734

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:S1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb843b05-b0fc-4165-83c6-5fefa98f6f7c

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:S0039

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c614775b-cc8d-4e60-8415-68a10fe9579d

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1074.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c710daae-cde1-4170-ae45-4910b3187cd8

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d1c6f29d-56e0-4d46-a7ec-a6d0a868cde3

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:S1099

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d86f1575-e31e-49db-a66d-b0364b819873

Kaspersky ToddyCat June 2022

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:S1100

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da51fa84-a70c-4a1c-8c77-a063b200e8ab

Kaspersky ToddyCat June 2022

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e8352090-00a3-4a0b-b8ba-c2308bdc9312

Kaspersky ToddyCat June 2022

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--efab47f3-cd77-41a5-bb8d-34ee3911d07d

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fff9a9cb-3032-4f18-a626-ce34a82e59ec

Kaspersky ToddyCat Check Logs October 2023

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.