ToddyCat is making holes in your infrastructure

ToddyCat, an APT targeting Asia‑Pacific government and defense-related organizations, employs multiple tunneling and persistence mechanisms (reverse OpenSSH tunnels, SoftEther VPN, ngrok, FRP, DLL side‑loading) and bespoke/modified tools (cuthead for bulk document collection, WAExp for WhatsApp local storage, TomBerBil for browser credential/cookie extraction, Krong proxy) to harvest and exfiltrate large volumes of sensitive data; the report provides sample commands, filesystem paths, C2 hosts, and mitigation recommendations.