ToddyCat
ToddyCat is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 4 sectors, including Government, and Defense and Aerospace, in 24 countries, including the United Kingdom and India. It uses 54 MITRE ATT&CK techniques and exploits 7 known CVEs.
Also known as
- Storm-0247
- Operation “Stayin’ Alive”
- Origin
- China
- Techniques
- 54
- Exploited CVEs
- 7
- First seen
- Jan 1, 2020
- Last seen
- Oct 12, 2023
- Record updated
Who They Target.
Countries · 24
Labelsespionageeurope
About ToddyCat.
ToddyCat is a sophisticated threat group that has been active since at least 2020 using custom loaders and malware in multi-stage infection chains against government and military targets across Europe and Asia.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.