H3XA — Operational Evidence

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[ToddyCat](https://attack.mitre.org/groups/G1022) is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kaspersky ToddyCat Check Logs October 2023)

34 recorded

Relationships

uses

to Archive via Utility

Technique

uses

to China Chopper

Malware

uses

to Cobalt Strike

Malware

uses

to Data from Local System

Technique

uses

to Disable or Modify System Firewall

Technique

uses

to Domain Account

Technique

uses

to Domain Accounts

Technique

uses

to Domain Groups

Technique

uses

to Exfiltration to Cloud Storage

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to File and Directory Discovery

Technique

uses

to Hidden Window

Technique

uses

to Local Storage Discovery

Technique

uses

Malware

uses

to Match Legitimate Resource Name or Location

Technique

uses

Technique

uses

to Net

Tool

uses

Tool

uses

Malware

uses

to Non-Application Layer Protocol

Technique

uses

Malware

uses

Tool

uses

Technique

uses

to Process Discovery

Technique

uses

to Remote Data Staging

Technique

uses

to Remote System Discovery

Technique

uses

Malware

uses

to Scheduled Task

Technique

uses

to Security Software Discovery

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to Spearphishing via Service

Technique

uses

to System Network Connections Discovery

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

3 external

References

mitre-attack

G1022

Kaspersky ToddyCat June 2022

https://securelist.com/toddycat/106799/

Kaspersky ToddyCat Check Logs October 2023

https://securelist.com/toddycat-keep-calm-and-check-logs/110696/