ToddyCat__2022__ToddyCat_Unveiling_an_unknown_APT_actor_attacking_high-profile_entities_in_Europe_and_Asia_Securelist.pdf

ToddyCat is a sophisticated APT group targeting high-profile government and military entities in Europe and Asia since December 2020, using a multi-stage infection chain built around Samurai backdoor and Ninja Trojan, with loaders, registry persistence, and a modular .NET backdoor to control compromised systems via HTTP/S C2.