Not SimonKaspersky reports on TTPs used by the cyberespionage group ToddyCat, an APT with little history and not currently attributed to any country. ToddyCat uses LoFiSe and PcExter for collecting and exfiltrating flies. They used reverse SSH tunnel to maintain access, server utility (VPN Server) from the SoftEther VPN, Ngrok agent and Krong (proxy), FRP client (fast reverse proxy), a new tool called Cuthead for data collection, WAExp (WhatsApp data stealer), and TomBerBil for stealing passwords from browsers. IOC included. 🔗 https://securelist.com/toddycat-traffic-tunneling-data-extraction-tools/112443/
Brian Clark@simontsui Goid report, thx for sharing. Interesting how fastidious the threat actors were about maintaining persistence. Three separate and independent remote access methods!
@deepthoughts10 I had to go back to the original article to see any mentions to China. After the iSoon leaks, I suspect ToddyCat is yet another hackers-for-hire company in China's private industry.