Skip to content

Ninja

Software · ATTACK:enterprise:S1100

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S1100",
  "title": "Ninja",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S1100",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--023254de-caaf-4a05-b2c7-e4e2f283f7a5",
  "external_id": "S1100",
  "domain": "enterprise",
  "created": "2024-01-11T18:40:51.497Z",
  "modified": "2025-10-22T02:17:48.978Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Kaspersky ToddyCat June 2022",
      "url": "https://securelist.com/toddycat/106799/"
    }
  ]
}

Explicit source assertions (29)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18b6546b-90a1-4f70-8faf-505810bba9a6

Kaspersky ToddyCat June 2022 · Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2302de7d-8c9a-4a92-93d3-e4b00c40b22d

Kaspersky ToddyCat June 2022 · Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3109f288-8024-4ae4-a284-f4f87d94f33d

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41863df8-b6c3-40df-84bc-3db0ec4f0bc5

Kaspersky ToddyCat June 2022

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1566.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46b26f19-5b16-4cd9-b031-2eae4910dd3e

Kaspersky ToddyCat June 2022

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49430af3-18b0-40e1-a500-5deab8ea8e48

Kaspersky ToddyCat June 2022

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ebc45da-6c79-4d9f-9c25-144ff55f70c9

Kaspersky ToddyCat June 2022 · Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f667e29-dd41-4dd4-a74d-fff899fe4ac6

Kaspersky ToddyCat June 2022 · Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60ef22cb-b7e7-4426-ab3a-11254fe63154

Kaspersky ToddyCat June 2022

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a822142-8cf6-4830-881a-be8630a4bf90

Kaspersky ToddyCat June 2022

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6cbe59bb-e66e-456e-b230-5880ae6fd5ac

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--708161ff-7d5d-417a-83ad-d68ec6d4d01a

Kaspersky ToddyCat June 2022 · Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78160020-3c63-4e60-81f4-f6438bfbd6a4

Kaspersky ToddyCat June 2022 · Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--784ac574-4c0d-485e-ae56-63d3b88e383f

Kaspersky ToddyCat June 2022

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8099e8d0-d8a1-407e-ba20-cfae2ae9f640

Kaspersky ToddyCat June 2022

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1480.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81089e7a-66d8-49a4-9acc-f786c3cfb1a0

Kaspersky ToddyCat June 2022

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--887626bc-bccf-4460-bd4c-af829a178ff9

Kaspersky ToddyCat June 2022 · Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88ae2900-c8c5-4943-8baa-7a8ba96dcef5

Kaspersky ToddyCat June 2022 · Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1218.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c720d3f-ad94-4668-a7f4-75104109df53

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--967ab393-8181-4a66-a406-39459b4a1ac7

Kaspersky ToddyCat June 2022 · Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba55652b-771c-4716-9074-6de786905c98

Kaspersky ToddyCat June 2022

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bfa1942d-31b1-454f-b1db-be67550f82ee

Kaspersky ToddyCat June 2022 · Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c516fa38-8bf4-4e8a-af64-09f6973825e6

Kaspersky ToddyCat June 2022

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d77572dd-686b-44c1-8f4b-55222e2ca908

Kaspersky ToddyCat June 2022

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d90871a8-1d79-4c9f-99c4-852d5f584392

Kaspersky ToddyCat June 2022 · Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:S1100

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da51fa84-a70c-4a1c-8c77-a063b200e8ab

Kaspersky ToddyCat June 2022

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1070.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dce1aedd-ea3f-4301-b44b-dae14d411697

Kaspersky ToddyCat June 2022

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1559

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e4d5f735-1629-48f8-9728-f76adf586a0b

Kaspersky ToddyCat June 2022

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1132.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e5a20948-878d-4853-ba7a-d49eae0cbae9

Kaspersky ToddyCat June 2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.