Threat actor
ToddyCat
China
Tracked by CyberSIXT since 21 Nov 2025
- Articles · all time
- 7
- Articles · last 30 days
- 0
- CVEs exploited · attributed
- 0
- Research reports · all time
- 1
7 articles from 1 outlet since 21 Nov 2025; the latest 115 days ago.
- Article
- First report
- Research report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Fri 3 Jul · 08:13 UTC | SecurityOnline | ToddyCat APT hijacks corporate Gmail via Umbrij OAuth theft |
| Thu 2 Jul · 14:11 UTC | The Hacker News | Umbrij Malware Hijacks Gmail via OAuth, Raising Security Fears |
| Tue 30 Jun · 17:21 UTC | DataBreaches | Kaspersky Warns of ToddyCat Gmail Hack via Shadow Token Technique |
| Tue 30 Jun · 10:11 UTC | Securelist | ToddyCat APT’s Umbrij Tool Steals Corporate Gmail via Google API |
| Tue 25 Nov 2025 · 12:45 UTC | The Hacker News | ToddyCat’s New Hacking Tools Steal Outlook Emails and Microsoft 365 Access Tokens |
| Tue 25 Nov 2025 · 00:50 UTC | SecurityOnline | ToddyCat APT Steals Microsoft 365 Cloud Email by Dumping OAuth Tokens from Memory and Copying Locked OST Files |
| Fri 21 Nov 2025 · 10:40 UTC | Securelist | ToddyCat: your hidden email assistant. Part 1 |
Names and sources
- ToddyCat
- Named by CyberSIXT coverage
- ToddyCat APT
- Named by CyberSIXT coverage
- ToddyCat
- Named by Malpedia · toddycat
- Websiic
- Named by Malpedia · toddycat
- Storm-0247
- Named by Microsoft · Storm-0247
- ToddyCat
- Named by Microsoft · Storm-0247
- Websiic
- Named by Microsoft · Storm-0247
- ToddyCat
- Named by MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b
All 11 names
- Websiic
- Named by MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b
- ToddyCat
- Named by MITRE ATT&CK · G1022
- 091a0b69-74de-44b6-bb12-16b7a8fd078b
- Named by CyberSIXT coverage
Attributed facts
- category
- state (Microsoft · Storm-0247)
- origin
- China (Microsoft · Storm-0247)
- sector
- Government (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
- sector
- Military (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
- Target country
- Afghanistan (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
- Target country
- India (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
- Target country
- Indonesia (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
- Target country
- Iran (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
- Target country
- Kyrgyzstan (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
- Target country
- Malaysia (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
- Target country
- Pakistan (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
- Target country
- Russia (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
- Target country
- Slovakia (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
- Target country
- Taiwan (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
- Target country
- Thailand (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
- Target country
- United Kingdom (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
- Target country
- Uzbekistan (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
- Target country
- Vietnam (MISP Galaxy · 091a0b69-74de-44b6-bb12-16b7a8fd078b)
Malware and tools
ATT&CK techniques
Tactic not recorded
- T1005
- Data from Local System (MITRE ATT&CK · G1022)
- T1018
- Remote System Discovery (MITRE ATT&CK · G1022)
- T1021.002
- SMB/Windows Admin Shares (MITRE ATT&CK · G1022)
- T1036.005
- Match Legitimate Resource Name or Location (MITRE ATT&CK · G1022)
- T1047
- Windows Management Instrumentation (MITRE ATT&CK · G1022)
- T1049
- System Network Connections Discovery (MITRE ATT&CK · G1022)
- T1053.005
- Scheduled Task (MITRE ATT&CK · G1022)
- T1057
- Process Discovery (MITRE ATT&CK · G1022)
- T1059.001
- PowerShell (MITRE ATT&CK · G1022)
- T1059.003
- Windows Command Shell (MITRE ATT&CK · G1022)
- T1069.002
- Domain Groups (MITRE ATT&CK · G1022)
- T1074.002
- Remote Data Staging (MITRE ATT&CK · G1022)
© The MITRE Corporation. Reproduced with permission. All techniques on MITRE ATT&CK
- ToddyCat APT hijacks corporate Gmail via Umbrij OAuth theftSecurityOnline
- Umbrij Malware Hijacks Gmail via OAuth, Raising Security FearsThe Hacker News
- Kaspersky Warns of ToddyCat Gmail Hack via Shadow Token TechniqueDataBreaches
- ToddyCat APT’s Umbrij Tool Steals Corporate Gmail via Google APISecurelist
- ToddyCat’s New Hacking Tools Steal Outlook Emails and Microsoft 365 Access TokensThe Hacker News
- ToddyCat APT Steals Microsoft 365 Cloud Email by Dumping OAuth Tokens from Memory and Copying Locked OST FilesSecurityOnline
- ToddyCat: your hidden email assistant. Part 1Securelist · first in our coverage