ThreatNexus
Nation-state APT intelligence
Dossiers Open app
ChinaAssessedChina-basedEspionageActive 2020 – 2025

ToddyCat

Also known asStorm-0247 · Websiic

7ATT&CK techniques5Malware & tools2Exploited CVEs3Campaigns3Sectors
Open the interactive dossier Diamond Model Hunt coverage Tradecraft lanes
Share

Summary

Espionage group (MITRE G1022; Microsoft: Storm-0247, origin China) active since at least 2020 against government, military and defence-contractor targets in Asia and Europe. Kaspersky, which named it, found its victims match those of Chinese-speaking groups but could not tie it to a known actor. It began in December 2020 by compromising Exchange servers in Taiwan and Vietnam and spread widely after ProxyLogon (CVE-2021-26855; T1190), deploying its Samurai passive backdoor, which takes commands over UDP (T1095), and the Ninja Trojan, sometimes sent as zip archives over Telegram (T1566.003). Post-compromise it uses stolen domain-admin credentials to mount shares (T1078.002), hidden PowerShell (T1564.003), archiving with 7-Zip and RAR (T1560.001) and Dropbox exfiltration (T1567.002). In early 2024 Kaspersky caught its TCESB tool loading through a DLL-search-order flaw in ESET's command-line scanner (CVE-2024-11859); from the second half of 2024 into 2025 it copied locked Outlook OST files with TCSectorCopy and harvested Microsoft 365 OAuth tokens from browsers to read corporate email.

Attribution

AssessedResearch assessment: China-based

Microsoft lists Storm-0247 (ToddyCat) as China; Kaspersky could not tie it to a known group

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

Sources
  • Microsoft (Research, 2026-10)
    Storm-0247 (ToddyCat, Websiic) listed with origin China
  • Kaspersky GReAT (Research, 2022-06-21)
    Victims match those of Chinese-speaking groups; not attributed to a known group

Campaigns 3

CampaignPeriodTargetsSectorsSource
Corporate email theft — Outlook OST copying (TCSectorCopy) and Microsoft 365 OAuth token harvesting2024-07 – 2025UndisclosedUndisclosedKaspersky GReAT (2025-11-21)
TCESB loaded through ESET's command-line scanner (CVE-2024-11859) to evade monitoring2024UndisclosedUndisclosedKaspersky ICS CERT (2025-04-07)
Exchange-server compromises with the Samurai backdoor and Ninja Trojan, widening after ProxyLogon2020-12 – 2021Taiwan, Vietnam, Afghanistan, India, Iran, Malaysia, Pakistan, Russia, Slovakia, Thailand, UK, Kyrgyzstan, Uzbekistan, IndonesiaGovernment, Military, DefenseKaspersky GReAT (2022-06-21)

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 7

Initial Access3T1190Exploit Public-Facing ApplicationT1566.003Spearphishing via ServiceT1078.002Domain Accounts
Stealth1T1564.003Hidden Window
Collection1T1560.001Archive via Utility
Exfiltration1T1567.002Exfiltration to Cloud Storage
Command and Control1T1095Non-Application Layer Protocol

Malware and tools 5

NameDescriptionPlatform
SamuraiPassive backdoor (UDP)Windows
NinjaTrojan / post-exploitation toolkitWindows
LoFiSeFile collectorWindows
TCESBDefence-evasion loader (DLL proxying, BYOVD)Windows
TCSectorCopyRaw-sector file copier (locked OST files)Windows

Exploited vulnerabilities 2

CVECVSSDetail
CVE-2021-268559.1Microsoft Exchange Server — ProxyLogon SSRF (KEV 2021-11-03)
CVE-2024-118598.4ESET Command-line scanner — DLL search-order hijacking (not in KEV)

Highest CVSS first.

Infrastructure patterns

  • China Chopper web shell on compromised Exchange servers as the first stage (Kaspersky 2022)
  • Locked Outlook OST files copied sector-by-sector; browser OAuth tokens reused off-network (Kaspersky 2025)

Reporting and advisories 4