ToddyCat Hacker Group Uses Advanced Tools for Industrial-Scale Data Theft

ToddyCat is an APT targeting government and military entities in the Asia‑Pacific that uses a wide range of backdoors, exfiltration tools (LoFiSe, Pcexter), tunneling solutions (reverse SSH/OpenSSH, SoftEther, Ngrok, Krong, FRP) and credential/cookie stealers (TomBerBil, WAExp) to automate industrial‑scale data harvesting and maintain redundant persistent access; Kaspersky documents active use and recommends blocking tunneling cloud services and preventing browser‑stored passwords.