Threat intelligence

Suspected origin

China

First seen

2020-01-01 00:00:00

Motivation

Information theft and espionage

Targeted sectors

Defense, Government, Telecommunications

TLP

WHITE

(Kaspersky) ToddyCat is a relatively new APT actor that we have not been able to relate to other known actors, responsible for multiple sets of attacks detected since December 2020 against high-profile entities in Europe and Asia. We still have little information about this actor, but we know that its main distinctive signs are two formerly unknown tools that we call ‘Samurai backdoor’ and ‘Ninja Trojan’.

Also known as

Storm-0247ToddyCat

Vulnerabilities exploited

CVE-2021-26855

Tooling and malware

China ChopperCobalt StrikeLoFiSeNinjaPcexterSamuraiNetnetstatPing

MITRE ATT&CK techniques

T1005 Data from Local SystemT1095 Non-Application Layer ProtocolT1686 Disable or Modify System FirewallT1018 Remote System DiscoveryT1049 System Network Connections DiscoveryT1057 Process DiscoveryT1083 File and Directory DiscoveryT1680 Local Storage DiscoveryT1047 Windows Management InstrumentationT1106 Native APIT1190 Exploit Public-Facing Application

Coverage 2

threat-intel

ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API

The ToddyCat APT group is utilizing a new malware, Umbrij, to gain unauthorized access to Gmail accounts via the Google API. Umbrij leverages the OAuth 2.0 protocol to obtain access tokens, allowing attackers to control…

The Hacker News · Jul 2, 2026 High

RUoauthgoogle apiheadless browser

threat-intel

ToddyCat: your hidden email assistant. Part 2

This report details the tactics employed by the ToddyCat APT group, focusing on a new technique dubbed ‘Shadow Token via Remote Debug’ (STRD) to compromise Gmail accounts. The group utilized a tool named Umbrij to gain a…

Securelist · Jun 30, 2026 High

UScredential_accessgoogle_apioauth2

All articles