Article Details
Scrape Timestamp (UTC): 2024-04-22 15:14:13.678
Source: https://thehackernews.com/2024/04/russian-hacker-group-toddycat-uses.html
Original Article Text
Click to Toggle View
Russian Hacker Group ToddyCat Uses Advanced Tools for Industrial-Scale Data Theft. The threat actor known as ToddyCat has been observed using a wide range of tools to retain access to compromised environments and steal valuable data. Russian cybersecurity firm Kaspersky characterized the adversary as relying on various programs to harvest data on an "industrial scale" from primarily governmental organizations, some of them defense related, located in the Asia-Pacific region. "To collect large volumes of data from many hosts, attackers need to automate the data harvesting process as much as possible, and provide several alternative means to continuously access and monitor systems they attack," security researchers Andrey Gunkin, Alexander Fedotov, and Natalya Shornikova said. ToddyCat was first documented by the company in June 2022 in connection with a series of cyber attacks aimed at government and military entities in Europe and Asia since at least December 2020. These intrusions leveraged a passive backdoor dubbed Samurai that allows for remote access to the compromised host. A closer examination of the threat actor's tradecraft has since uncovered additional data exfiltration tools like LoFiSe and Pcexter to gather data and upload archive files to Microsoft OneDrive. The latest set of programs entail a mix of tunneling data gathering software, which are put to use after the attacker has already obtained access to privileged user accounts in the infected system. This includes - "The attackers are actively using techniques to bypass defenses in an attempt to mask their presence in the system," Kaspersky said. "To protect the organization's infrastructure, we recommend adding to the firewall denylist the resources and IP addresses of cloud services that provide traffic tunneling. In addition, users must be required to avoid storing passwords in their browsers, as it helps attackers to access sensitive information." Goodbye, Atlassian Server. Goodbye… Backups? Protect your data on Atlassian Cloud from disaster with Rewind's daily backups and on-demand restores. How to Update and Automate Outdated Security Processes Download the eBook for step-by-step guidance on how to update your security processes as your business grows.
Daily Brief Summary
Russian hacker group ToddyCat uses sophisticated tools to conduct data theft on an industrial scale, primarily targeting governmental and defense organizations in the Asia-Pacific region.
Security firm Kaspersky reports that ToddyCat automates data harvesting and maintains multiple methods for persistent access and system monitoring since at least December 2020.
The group employs a passive backdoor known as Samurai, allowing remote access to compromised systems, alongside other tools like LoFiSe and Pcexter for data extraction and uploading to cloud services.
ToddyCat was first identified in June 2022 following a series of cyberattacks on European and Asian government and military entities.
New findings reveal the use of advanced tunneling and data-gathering software post-initial breach, aiming to sustain access to privileged accounts and hide their activities within the infected systems.
Kaspersky advises enhancing security by blacklisting IPs and resources associated with traffic tunneling and enforcing stricter password management policies among users to prevent sensitive information access.