{"type":"bundle","id":"bundle--93eabd41-a31f-5a72-9617-7186765737c4","objects":[{"type":"intrusion-set","id":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"ToddyCat","aliases":["ToddyCat","Websiic","G1022"],"first_seen":"2020-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/toddycat"},{"source_name":"mitre-attack","external_id":"G1022","url":"https://attack.mitre.org/groups/G1022/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--9ac4a0ed-b602-5474-83c2-049572b47840","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","relationship_type":"uses","source_ref":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"Archive via Utility","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.001","url":"https://attack.mitre.org/techniques/T1560/001"}]},{"type":"relationship","id":"relationship--b6d38dda-6646-57da-aef0-6cc188c5f60e","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","relationship_type":"uses","source_ref":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","target_ref":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--20df04e3-527b-51c9-bdfc-18b2fa439b81","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","relationship_type":"uses","source_ref":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"Exploit Public-Facing Application","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190"}]},{"type":"relationship","id":"relationship--b30f56eb-881e-5bf9-89d9-f9a73c84879d","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","relationship_type":"uses","source_ref":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","target_ref":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--e0f490e4-ada0-575d-895b-5f0d92cbbb96","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","relationship_type":"uses","source_ref":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--27a758e7-0bf7-5513-bcf7-7e89394afd05","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","relationship_type":"uses","source_ref":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"SMB/Windows Admin Shares","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.002","url":"https://attack.mitre.org/techniques/T1021/002"}]},{"type":"relationship","id":"relationship--9fff5b7a-34e3-5811-856b-c6972eb23ce5","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","relationship_type":"uses","source_ref":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","target_ref":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75"},{"type":"attack-pattern","id":"attack-pattern--97f03df4-8d90-5c9d-baf3-f1d6dbf82dc8","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"Native API","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1106","url":"https://attack.mitre.org/techniques/T1106"}]},{"type":"relationship","id":"relationship--7d80b42c-c5e5-522c-98b5-b2fe867d0f6f","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","relationship_type":"uses","source_ref":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","target_ref":"attack-pattern--97f03df4-8d90-5c9d-baf3-f1d6dbf82dc8"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--eb07d84a-c74d-50e4-aa06-ebf3452d1de1","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","relationship_type":"uses","source_ref":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"Exfiltration to Cloud Storage","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1567.002","url":"https://attack.mitre.org/techniques/T1567/002"}]},{"type":"relationship","id":"relationship--d2f369e6-1c37-5b43-92a9-e6742b99f9f4","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","relationship_type":"uses","source_ref":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","target_ref":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221"},{"type":"attack-pattern","id":"attack-pattern--a184b572-e2fb-5214-87a2-69848edd3a9a","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"Domain Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.002","url":"https://attack.mitre.org/techniques/T1078/002"}]},{"type":"relationship","id":"relationship--e1a6b052-81e7-5b21-9ed7-0cdca48f6d66","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","relationship_type":"uses","source_ref":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","target_ref":"attack-pattern--a184b572-e2fb-5214-87a2-69848edd3a9a"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--93743643-e6e6-57dd-987c-68ef9d02ab7a","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","relationship_type":"uses","source_ref":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--fc9da914-6e6a-5d6a-ac7e-fe8d8a3e655c","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","relationship_type":"uses","source_ref":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"Process Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1057","url":"https://attack.mitre.org/techniques/T1057"}]},{"type":"relationship","id":"relationship--e5ba92d2-e1c8-54f0-a9f7-ffeb3531dd9e","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","relationship_type":"uses","source_ref":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","target_ref":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4"},{"type":"attack-pattern","id":"attack-pattern--948a3131-b9eb-5fd9-9e5b-37081e8f5a85","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"Non-Application Layer Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1095","url":"https://attack.mitre.org/techniques/T1095"}]},{"type":"relationship","id":"relationship--e9ea26ec-5b84-56ba-919d-2ed866584256","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","relationship_type":"uses","source_ref":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","target_ref":"attack-pattern--948a3131-b9eb-5fd9-9e5b-37081e8f5a85"},{"type":"attack-pattern","id":"attack-pattern--5dddb85a-c488-5311-9b00-314f07a79721","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"Hidden Window","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1564.003","url":"https://attack.mitre.org/techniques/T1564/003"}]},{"type":"relationship","id":"relationship--d991cf95-1f80-549b-b927-5777bf159ffd","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","relationship_type":"uses","source_ref":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","target_ref":"attack-pattern--5dddb85a-c488-5311-9b00-314f07a79721"},{"type":"attack-pattern","id":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"Remote System Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1018","url":"https://attack.mitre.org/techniques/T1018"}]},{"type":"relationship","id":"relationship--c3682f84-7a68-5b02-90cf-9b6d636cbc45","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","relationship_type":"uses","source_ref":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","target_ref":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d"},{"type":"attack-pattern","id":"attack-pattern--6b587822-f319-5e97-a60e-749521b0fbe7","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"Local Storage Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1680","url":"https://attack.mitre.org/techniques/T1680"}]},{"type":"relationship","id":"relationship--77ecb1fd-6cbd-5c09-be92-90dd21e1bb72","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","relationship_type":"uses","source_ref":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","target_ref":"attack-pattern--6b587822-f319-5e97-a60e-749521b0fbe7"},{"type":"attack-pattern","id":"attack-pattern--9eb184f4-55af-53a7-97c4-5f226ca51dd7","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"Spearphishing via Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.003","url":"https://attack.mitre.org/techniques/T1566/003"}]},{"type":"relationship","id":"relationship--5beefae2-2031-54fc-b19c-278ee949e307","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","relationship_type":"uses","source_ref":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","target_ref":"attack-pattern--9eb184f4-55af-53a7-97c4-5f226ca51dd7"},{"type":"attack-pattern","id":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"System Network Connections Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1049","url":"https://attack.mitre.org/techniques/T1049"}]},{"type":"relationship","id":"relationship--7b2b0970-dd85-530c-b106-4263fe93db4a","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","relationship_type":"uses","source_ref":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","target_ref":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612"},{"type":"attack-pattern","id":"attack-pattern--ef0a62d7-89c9-55f5-96aa-755d77e7e7ee","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","name":"Disable or Modify System Firewall","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1686","url":"https://attack.mitre.org/techniques/T1686"}]},{"type":"relationship","id":"relationship--5564381f-4e3a-51aa-b497-7398919fe801","spec_version":"2.1","created":"2026-05-20T09:52:28.593529+00:00","modified":"2026-07-29T07:07:09.173+00:00","relationship_type":"uses","source_ref":"intrusion-set--6bb1650b-0652-5ee2-94ad-b6a6a4593344","target_ref":"attack-pattern--ef0a62d7-89c9-55f5-96aa-755d77e7e7ee"}]}