Threat intelligence / Malware

Ninja

[Ninja](https://attack.mitre.org/software/S1100) is a malware developed in C++ that has been used by [ToddyCat](https://attack.mitre.org/groups/G1022) to penetrate networks and control remote systems since at least 2020. [Ninja](https://attack.mitre.org/software/S1100) is possibly part of a post exploitation toolkit exclusively used by [ToddyCat](https://attack.mitre.org/groups/G1022) and allows multiple operators to work simultaneously on the same machine. [Ninja](https://attack.mitre.org/software/S1100) has been used against government and military entities in Europe and Asia and observed in specific infection chains being deployed by [Samurai](https://attack.mitre.org/software/S1099).(Citation: Kaspersky ToddyCat June 2022)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Ninja](https://attack.mitre.org/software/S1100) is a malware developed in C++ that has been used by [ToddyCat](https://attack.mitre.org/groups/G1022) to penetrate networks and control remote systems since at least 2020. [Ninja](https://attack.mitre.org/software/S1100) is possibly part of a post exploitation toolkit exclusively used by [ToddyCat](https://attack.mitre.org/groups/G1022) and allows multiple operators to work simultaneously on the same machine. [Ninja](https://attack.mitre.org/software/S1100) has been used against government and military entities in Europe and Asia and observed in specific infection chains being deployed by [Samurai](https://attack.mitre.org/software/S1099).(Citation: Kaspersky ToddyCat June 2022)

Labels

malware

29 recorded

Relationships

uses

Technique

uses

to Data Obfuscation

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to DLL

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Environmental Keying

Technique

uses

to File and Directory Discovery

Technique

uses

to Internal Proxy

Technique

uses

to Inter-Process Communication

Technique

uses

to Local Storage Discovery

Technique

uses

to Malicious File

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Multi-hop Proxy

Technique

uses

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to Non-Standard Encoding

Technique

uses

to Process Discovery

Technique

uses

to Process Injection

Technique

uses

to Protocol or Service Impersonation

Technique

uses

Technique

uses

to Scheduled Transfer

Technique

uses

to Spearphishing via Service

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

Technique

uses

to Web Protocols

Technique

uses

to Windows Service

Technique

uses

Group

2 external

References

mitre-attack

S1100

Kaspersky ToddyCat June 2022

https://securelist.com/toddycat/106799/