ToddyCat Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (43)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	28
zh	10
sv	2
de	2
fr	2

Country

cn	26
us	14

Actors

ToddyCat	5
Cobalt Strike	3
DarkCrystalRAT	1
TeslaCrypt	1

Activities

Interest

Timeline

Type

Not Defined	12
Programming Language Software	8
Router Operating System	4
Content Management System	4
Knowledge Base Software	2

Vendor

Not Defined	18
ZyXEL	2
SAP	2
D-Link	2
F5	2

Product

PHP	6
Ratpack	2
ZyXEL P660HN-T v1	2
SAP Knowledge Management	2
D-Link DIR-816L	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	1.06	CVE-2010-0966
2	Watchguard Firebox/XTM Remote Code Execution	6.3	6.0	$0-$5k	$0-$5k	High	Official Fix	0.84170	0.00	CVE-2022-26318
3	WordPress Password Reset wp-login.php mail password recovery	6.1	5.8	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.02827	0.05	CVE-2017-8295
4	request-baskets API Request {name} server-side request forgery	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.08109	0.00	CVE-2023-27163
5	bassmaster plugin batch.js internalsbatch code injection	9.8	9.4	$0-$5k	$0-$5k	High	Official Fix	0.87994	0.05	CVE-2014-7205
6	QNAP QTS/QuTS Hero/QVP/QVR os command injection	6.7	6.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00115	0.00	CVE-2023-23355
7	Google Android Settings.java getStringsForPrefix Local Privilege Escalation	6.5	6.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00042	0.00	CVE-2023-20919
8	Linux Kernel rcar_drif.c rcar_drif_g_fmt_sdr_cap Memory information disclosure	4.4	4.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00047	0.02	CVE-2019-18786
9	Page Engine CMS login_include.php privileges management	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.00
10	D-Link DIR-816L/DIR-803 URL Encoding info.php cross site scripting	5.2	5.2	$5k-$25k	$0-$5k	Not Defined	Unavailable	0.00111	0.00	CVE-2020-25786
11	Discuz! DiscuzX Access Restriction index.php access control	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00303	0.02	CVE-2018-5377
12	Ratpack deserialization	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00234	0.00	CVE-2021-29485
13	Spring Framework Multipart Request privileges management	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00046	0.00	CVE-2021-22118
14	F5 BIG-IP Advanced WAF Appliance Mode Restrictions integrity check	7.9	7.8	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00065	0.04	CVE-2022-25946
15	Progress MOVEit Transfer sql injection	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00131	0.00	CVE-2021-38159
16	PHP Link Directory Administration Page index.html cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00374	0.21	CVE-2007-0529
17	Kingsoft WPS Office Registry wpsupdater.exe access control	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00924	0.02	CVE-2022-24934
18	Smartisoft phpBazar classified_right.php file inclusion	6.5	6.2	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.00933	0.05	CVE-2006-2528
19	ZyXEL P660HN-T v1 ViewLog.asp command injection	7.3	6.4	$5k-$25k	$0-$5k	Proof-of-Concept	Workaround	0.00000	0.04
20	Cisco ASA/Firepower Threat Defense Web Services Interface out-of-bounds write	6.9	6.8	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00195	0.00	CVE-2021-34704

Campaigns (1)

These are the campaigns that can be associated with the actor:

Ninja

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Identified	Type	Confidence
1	45.76.78.237	45.76.78.237.vultrusercontent.com	ToddyCat		07/31/2022	verified	High
2	XXX.XX.XXX.XX	xxx-xx-xxx-xx.xxxxxx.xxxxxxx-xxx.xxx	Xxxxxxxx		04/29/2024	verified	High
3	XXX.XXX.XX.XX		Xxxxxxxx		04/29/2024	verified	High
4	XXX.XXX.XX.XX	xxx.xxx.xx.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxx		07/31/2022	verified	High
5	XXX.XX.XX.XXX	xxx.xx.xx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxx	Xxxxx	06/28/2022	verified	High

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
3	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
4	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
5	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
6	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
7	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	High
8	TXXXX	CAPEC-50	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
9	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (32)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/api/baskets/{name}	predictive	High
2	File	archiver\index.php	predictive	High
3	File	awstats.pl	predictive	Medium
4	File	classified_right.php	predictive	High
5	File	xxxxxxx/xxxxx/xxxxxxxx/xxxx_xxxx.x	predictive	High
6	File	xxx/xxxx/xxxx.x	predictive	High
7	File	xxx/xxxxxx.xxx	predictive	High
8	File	xxxxxxxx/xxxxxxx/xxxxx_xxxxxxx.xxx	predictive	High
9	File	xxxxx.xxxx	predictive	Medium
10	File	xxxx.xxx	predictive	Medium
11	File	xxxx/xxxxxxxxx.xxx	predictive	High
12	File	xxxxxxxx.x	predictive	Medium
13	File	xxxxxxxx.xxxx	predictive	High
14	File	xxxx-xxxxxxx-xxxxxx.xxx	predictive	High
15	File	xxxxxxx.xxx	predictive	Medium
16	File	xxxx.xxx	predictive	Medium
17	File	xxxxxx/xx/xxxx.xxx	predictive	High
18	File	xx-xxxxx.xxx	predictive	Medium
19	File	xxxxxxxxxx.xxx	predictive	High
20	File	~/xxx/xxxx-xxxxxxxxx.xxx	predictive	High
21	Library	xxx/xxxxxx/xxxxxxxxx/xxxxxx.x	predictive	High
22	Library	xxx/xxxxx.xx	predictive	Medium
23	Argument	$_xxxxx	predictive	Low
24	Argument	xxxxxx	predictive	Low
25	Argument	xxxxxxxx	predictive	Medium
26	Argument	xxxxxx	predictive	Low
27	Argument	xxxxxxx	predictive	Low
28	Argument	xxxx	predictive	Low
29	Argument	xx	predictive	Low
30	Argument	xxxxxxxx_xxx	predictive	Medium
31	Argument	xxxxxx_xxxx	predictive	Medium
32	Input Value	%xxxxxx+-x+x+xx.x.xx.xxx%xx%xx	predictive	High

References (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Interested in the pricing of exploits?

See the underground prices here!