ToddyCat APT Hackers Exploiting Vulnerable Exchange Servers


ToddyCat, a highly skilled advanced persistent threat (APT) actor notorious for launching targeted attacks in Europe and Asia, has recently upgraded its arsenal of tools and methods, signifying an evolution in its modus operandi.

Recent findings from the cybersecurity researchers at SecureList by Kaspersky provide insights into their:-

  • New toolset
  • Data theft malware
  • Lateral movement techniques
  • Espionage operations

Researchers affirmed that the hackers behind the ToddyCat APT group are actively exploiting the vulnerable Microsoft Exchange servers.

Document

FREE Demo

Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware

Here below, we have mentioned all the tools that the threat actors behind the ToddyCat APT group use:-

  • Standard loaders
  • Tailored loader
  • Ninja
  • LoFiSe
  • DropBox uploader
  • Pcexter
  • Passive UDP backdoor
  • CobaltStrike

ToddyCat APT Exploiting Exchange Servers

ToddyCat conducts espionage by infiltrating networks with loaders and Trojans. After gaining access, they collect data about connected hosts and perform discovery activities, enumerating domain accounts and servers using standard OS utilities like net and ping:-

net group "domain admins" /dom
net user %USER% /dom
net group "domain computers" /dom | findstr %VALUABLE_USER%
ping %REMOTE_HOST% -4

Attackers regularly change credentials and employ scripts in a scheduled task that runs briefly and is removed, along with network shares, for each targeted host.

Scheduled tasks may include discovery commands or scripts for data collection. The attacker can access the Output from these tasks by mounting a remote drive as a local share during lateral movement.

PowerShell commands from the PS1 script were duplicated in a BAT script to evade detection.

To avoid suspicion, the group consistently employs common task names like ‘one’ and ‘tpcd’ for a session. Script names are random keyboard-walking characters. They mount and delete a temporary share on the exfiltration host at the end of their activity.

The threat actor gathers files from various hosts, archives them, and exfiltrates them via public storage.

LoFiSe, designed for file collection, is complemented by other scripts for enumerating and collecting recently modified documents with specific extensions.

Besides this, the script variants for data collection didn’t use compressed archives. Files were copied to specific folders, transferred manually to the exfiltration host via xcopy, and then compressed with 7z.

IOCs

Loaders
97D0A47B595A20A3944919863A8163D1                    Variant “Update”
828F8B599A1CC4A02A2C3928EC3F5F8B                     Variant “VLC” A
90B14807734045F1E0A47C40DF949AC4                     Variant “VLC” B
0F7002AACA8C1E71959C3EE635A85F14                     Tailored loader
D3050B3C7EE8A80D8D6700624626266D                    Tailored loader
D4D8131ED03B71D58B1BA348F9606DF7                    Tailored loader
Passive UDP backdoors
65AF75986577FCC14FBC5F98EFB3B47E
Dropbox exfiltrator
BEBBEBA37667453003D2372103C45BBF
LoFiSe
14FF83A500D403A5ED990ED86296CCC7
4AD609DDDF2C39CDA7BDBE2F9DC279FD
Pcexter
D0CD88352638F1AE101C2A13356AB6B7
318C16195F62094DADCC602B547BBE66
Dropper
C170F05333041C56BCC39056FECB808F

Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Take advantage of the free trial to ensure 100% security.



Source link