สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency

Report

Home > List all groups > List all tools > List all groups using tool LoFiSe

Threat Group Cards: A Threat Actor Encyclopedia

Tool: LoFiSe

Names	LoFiSe
Category	Malware
Type	Exfiltration
Description	(Kaspersky) This is a component designed to find and collect files of interest on targeted systems. The name LoFiSe derived from the mutex name used by this tool (‘MicrosoftLocalFileService’). The tool itself is a DLL file named DsNcDiag.dll that is launched using the DLL side-loading technique. The legitimate executable file with digital signature and original name nclauncher.exe from the software package Pulse Secure Network Connect 8.3 is used as a loader.
Information	<https://securelist.com/toddycat-keep-calm-and-check-logs/110696/>
MITRE ATT&CK	<https://attack.mitre.org/software/S1101>

Last change to this tool card: 19 June 2024

Download this tool card in JSON format

All groups using tool LoFiSe

Changed	Name	Country	Observed
APT groups
	ToddyCat		2020-2021

1 group listed (1 APT, 0 other, 0 unknown)

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Report incidents

+66 (0)2-123-1227

[email protected]