Actor Profile

ToddyCat (G1022) is an advanced persistent threat group that has demonstrated sophisticated capabilities in targeting corporate and enterprise environments. The actor is known for deploying custom malware toolsets and leveraging both publicly available frameworks (Cobalt Strike) and proprietary implants (LoFiSe, Pcexter, Samurai, Ninja, China Chopper). ToddyCat's motivation appears centered on espionage and data exfiltration, with a focus on compromising corporate email communications. The deployment of Umbrij represents an evolution in their tradecraft, specifically targeting cloud-based email services through OAuth abuse and Google API exploitation to maintain persistent access to Gmail accounts.

TTPs (Tactics, Techniques, Procedures)

ToddyCat employs a diverse set of TTPs across the attack lifecycle. Initial access is achieved through spearphishing with malicious attachments (T1566.003) and exploitation of public-facing applications (T1190). The group performs extensive discovery activities including domain group enumeration (T1069.002), domain account discovery (T1087.002), process discovery (T1057), remote system discovery (T1018), and network connection enumeration (T1049). For execution, they utilize Windows Command Shell (T1059.003), scheduled tasks (T1053.005), and the Windows API (T1106). Lateral movement is facilitated via SMB/Windows Admin Shares (T1021.002). The group maintains persistence through domain account abuse (T1078.002) and now OAuth token manipulation. Data collection focuses on local system data (T1005), while C2 communications leverage non-application layer protocols (T1095). The Umbrij malware introduces cloud API abuse (T1686) as a novel technique for email access and exfiltration.

Targets & Patterns

ToddyCat targets corporate and enterprise sectors with a focus on compromising organizational email communications. The deployment of Umbrij specifically targets Gmail users within corporate environments, suggesting the group is adapting to organizations using cloud-based email infrastructure rather than traditional on-premises Exchange servers. This targeting pattern indicates ToddyCat prioritizes intelligence collection from business communications, likely seeking proprietary information, strategic planning documents, and sensitive correspondence. The OAuth abuse technique suggests targeting of organizations with federated identity or BYOD policies that permit personal Gmail access, or enterprises using Google Workspace. The focus on email as an attack vector underscores the group's interest in long-term access to sensitive communications for espionage purposes.

Historical Context

ToddyCat has historically maintained a diverse malware arsenal including Cobalt Strike for post-exploitation, China Chopper webshells for persistence, and custom tools like LoFiSe, Pcexter, Samurai, and Ninja. The introduction of Umbrij represents a tactical shift toward cloud service exploitation, moving beyond traditional network-based intrusion methods. This evolution aligns with broader APT trends of targeting cloud infrastructure and SaaS platforms as organizations migrate to cloud-based services. The OAuth abuse technique marks a departure from ToddyCat's previously documented reliance on network protocols and on-premises infrastructure compromise, indicating the group is actively developing capabilities to maintain operational effectiveness against modern cloud-first enterprise environments.

Defensive Recommendations

  • Monitor OAuth token grants and API access patterns for Gmail/Google Workspace accounts, flagging unusual authorization requests or applications with broad email access scopes (detection for T1686)
  • Implement conditional access policies requiring device compliance and MFA for OAuth consent flows, particularly for third-party applications requesting email access permissions
  • Enable advanced logging for Google Workspace API activity (Admin SDK, Gmail API calls) and correlate with endpoint telemetry to detect unauthorized email access from compromised systems
  • Deploy detection rules for T1566.003 (spearphishing attachments) and T1190 (public-facing application exploitation) as primary initial access vectors, focusing on email gateway and perimeter defenses
  • Hunt for ToddyCat's known malware families (Cobalt Strike, China Chopper, LoFiSe, Pcexter, Samurai, Ninja) and monitor for lateral movement via T1021.002 (SMB/Admin Shares) combined with discovery commands (T1069.002, T1087.002, T1018)