APT group ToddyCat has continued advancing its espionage operations, targeting corporate email systems and internal communications across various organizations.
Their latest activity demonstrates an evolving capability to bypass monitoring systems and exfiltrate sensitive data via browser credential theft, email extraction, and token hijacking through Microsoft 365 services.
PowerShell Variant of TomBerBil Targets Browser Credentials
Between May and June 2024, security researchers detected a new PowerShell variant of TomBerBil, a malicious toolset developed by ToddyCat. Earlier versions written in C# and C++ were designed to collect cookies and passwords from web browsers.
The updated script runs with elevated privileges on domain controllers and accesses remote hosts over SMB shares.
The tool creates a local working directory (for instance, *C:\ProgramData\temp*) and compiles a list of hostnames from a supplied list. It then connects to \C$ administrative shares on remote systems to retrieve browser data from Chrome, Edge, and Firefox profiles.
Files such as Login Data, Local State, Cookies, and History are copied along with DPAPI encryption keys from AppData\Microsoft\Protect and Credentials directories.
These keys enable attackers to decrypt encrypted browser databases offline, yielding saved credentials and browsing histories from multiple employees.
Detection of this attack involves auditing SMB access to browser data paths and monitoring suspicious activity related to DPAPI key directories. Kaspersky-issued Sigma rules use Windows Security Event IDs 5145 and 4663 for identifying unauthorized network access attempts.
Outlook Data Theft and Token Extraction
When local credential theft became detectable, ToddyCat operators shifted tactics to focus on exfiltrating email data. A C++ utility named TCSectorCopy was deployed to clone locked Outlook OST files by performing low-level sector reads directly from the disk.
These files, containing cached Exchange or Microsoft 365 mailboxes, were later processed using XstReader, an open-source tool for exporting mail content to readable file formats.
Further investigations revealed the use of SharpTokenFinder, a C# tool that searches process memory dumps for JWT tokens associated with Microsoft 365 applications such as Outlook, Teams, and OneDrive.
The operators attempted to use Sysinternals’ ProcDump to extract tokens from these processes. Captured OAuth tokens enabled unauthorized access to cloud mailboxes without compromising the monitored systems.
Detection of such activity relies on monitoring ProcDump command-line arguments for Microsoft 365 process names and identifying Sysmon Event ID 9, which flags raw disk reads bypassing regular API calls.
ToddyCat’s latest campaign highlights an ongoing escalation in espionage tactics, combining traditional endpoint compromise with stealthy cloud authentication attacks.
Security experts recommend enabling advanced endpoint protection, cloud token monitoring, and continuous auditing to detect lateral movement before data extraction occurs.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
