Loading threat actor…
ToyMaker is a financially motivated initial access broker and intrusion cluster active since at least 2017, also tracked as Gold Melody, UNC961, Prophet Spider, and TGR-CRI-0045. The actor specializes in obtaining footholds in victim environments and transferring that access to downstream criminal operators, including ransomware groups such as Maze, Egregor, Cactus, and likely MountLocker. Reported victimology includes high-value organizations, including critical infrastructure, as well as organizations in financial services, manufacturing, wholesale and retail, high technology, transportation and logistics, and other enterprise environments in the United States and Europe. ToyMaker commonly targets exposed internet-facing systems and public-facing applications by exploiting known vulnerabilities. Reported intrusion vectors include Oracle WebLogic flaws, Log4Shell exploitation in VMware Horizon environments, SQL injection, and abuse of exposed ASP.NET Machine Keys to deliver malicious View State deserialization payloads against Microsoft IIS servers. The actor has also been characterized as favoring broad scanning for vulnerable servers and opportunistic compromise of externally exposed infrastructure. Operational tradecraft includes rapid post-compromise reconnaissance, credential harvesting, persistence, and limited post-exploitation before access handoff. In one well-documented intrusion, ToyMaker enumerated users and domains, created unauthorized local administrator accounts, enabled remote access components, captured memory from compromised hosts to harvest credentials, archived and exfiltrated those memory captures, and deployed a custom reverse-shell backdoor known as LAGTOY, which overlaps with malware tracked by another vendor as HOLERUN. LAGTOY has been associated with service-based persistence, raw-socket command-and-control over port 443, and anti-debugging logic. Separate reporting linked the cluster to in-memory .NET payload execution on IIS servers, use of a custom privilege-escalation utility based on GodPotato to obtain SYSTEM, creation of local administrator accounts, and internal discovery with a Golang port scanner. ToyMaker’s activity is notable for compartmentalization: the actor typically establishes access, performs enough reconnaissance and credential theft to increase the value of that access, and then transfers the foothold to secondary operators rather than conducting the full monetization phase itself. Follow-on actors have used the provided access for broader lateral movement, data theft, persistence, and ransomware deployment. This places ToyMaker among the more prominent financially motivated initial access groups operating in the cybercrime ecosystem.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
11 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 malware families attributed to this actor across reporting.
3 CVEs this actor has used in observed campaigns. 3 of them exploited in the wild.
Prophet Spider has also been seen using older Oracle CVEs such as CVE-2016-0545, as well as gaining initial access via SQL injection.
Researchers noticed a recent trend in which Prophet Spider uses CVE-2020-14882 and CVE-2020-14750 to get a foothold into target environments. Both CVEs relate to path traversal vulnerabilities that enable an attacker to access the WebLogic administrative console, which then allows for unauthenticated remote code execution.
Researchers noticed a recent trend in which Prophet Spider uses CVE-2020-14882 and CVE-2020-14750 to get a foothold into target environments. Both CVEs relate to path traversal vulnerabilities that enable an attacker to access the WebLogic administrative console, which then allows for unauthenticated remote code execution.
16 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Initial access broker activity associated with creating unauthorized user accounts and modifying Winlogon registry keys to enable automatic login and support follow-on ransomware deployment.
Initial access broker activity: scans for vulnerable systems, deploys LAGTOY/HOLERUN, and sells access to ransomware operators (e.g., CACTUS) enabling double extortion.
Initial access broker providing access to secondary ransomware actors such as Cactus using a custom credential-stealing backdoor.
Gold Melody is an initial access broker who compromises ASP.NET sites using leaked machine keys and sells access to the underlying IIS servers.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.