H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

LoFiSe

[LoFiSe](https://attack.mitre.org/software/S1101) has been used by [ToddyCat](https://attack.mitre.org/groups/G1022) since at least 2023 to identify and collect files of interest on targeted systems.(Citation: Kaspersky ToddyCat Check Logs October 2023)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[LoFiSe](https://attack.mitre.org/software/S1101) has been used by [ToddyCat](https://attack.mitre.org/groups/G1022) since at least 2023 to identify and collect files of interest on targeted systems.(Citation: Kaspersky ToddyCat Check Logs October 2023)

Labels

malware
7 recorded

Relationships

uses
to Archive Collected Data
Technique
uses
to Automated Collection
Technique
uses
to Data from Local System
Technique
uses
to DLL
Technique
uses
to File and Directory Discovery
Technique
uses
to Local Data Staging
Technique
uses
from ToddyCat
Group
2 external

References

mitre-attack
S1101
open
Kaspersky ToddyCat Check Logs October 2023
https://securelist.com/toddycat-keep-calm-and-check-logs/110696/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance