ToddyCat — Umbrij .NET Backdoor & the Shadow Token via Remote Debug (STRD) Technique

Umbrij is a .NET DLL backdoor (ConfuserEx-obfuscated) attributed by Kaspersky to ToddyCat, an Asia-nexus espionage actor known for targeting high-profile government and defence entities across Europe and Asia. Umbrij is purpose-built for one thing: surreptitiously reading a victim's Gmail / Google Workspace mailbox without ever needing the account password.

The novel tradecraft — which Kaspersky names Shadow Token via Remote Debug (STRD) — works by copying the victim's live browser profile, then launching Chrome/Edge in --headless mode with a --remote-debugging-port. Umbrij drives that debug port through PuppeteerSharp (the .NET Chrome DevTools Protocol library) to visit a Google OAuth URL for a legitimate Google Workspace migration client_id (GWMMO 279448736670, or GWSMO 1095133494869 with the -sync switch). Because the copied profile is still signed in, Google issues an authorization code with no password prompt; Umbrij exchanges it for an access token and reads mail via the Google API (scopes include https://mail.google.com/, gmail.insert, gmail.labels, drive, and admin.directory.user).

Umbrij is delivered by DLL side-loading: legitimate signed hosts (GoogleDesktop.exe, BDSubWiz.exe, VSTestVideoRecorder.exe) are dropped to user-writable staging paths (C:\Users\Public, C:\Windows\Vss, C:\Windows\Temp) alongside a malicious companion DLL (GoogleServices.DLL, log.dll, or the VideoRecorderEngine DLL). The launcher accepts switches such as -regex (find a target user by email substring), -browser, -debugport, -sync, and -deepsearch. Persistence is a scheduled task masquerading as KasperskyEndpointSecurityEDRAvp.

Defender priority: The highest-value, lowest-FP angles are a browser launched with both --remote-debugging-port and --headless (especially with --user-data-dir pointing at a BackupFiles copy), the three DLL-sideload host binaries running from Public/Vss/Temp, the Kaspersky-published Umbrij hashes, and the KasperskyEndpointSecurityEDRAvp scheduled task. Enforce Chrome policy DeveloperToolsAvailability=2 to break the remote-debug primitive outright.

Every atomic IOC below (MD5 hashes, host/DLL filenames, install paths, OAuth client_ids, scheduled-task name) traces to the Kaspersky Securelist indicator set. The OAuth client_ids and Google scopes are behavioural constants of the technique; the sideloaded filenames and staging paths are durable, while the debug-port number (e.g. 11111) is arbitrary and should be treated as illustrative, not a fixed indicator.

Hunt hypotheses (fidelity-ordered)

1. H1 (high): A browser was launched with both --remote-debugging-port and --headless — the core STRD primitive. Covers T1550.001 / T1528.
2. H2 (high): A headless remote-debug browser used --user-data-dir pointing at a copied profile (BackupFiles). STRD profile-clone tell.
3. H3 (high): One of the three DLL-sideload host binaries executed from C:\Users\Public, C:\Windows\Vss, or C:\Windows\Temp. Covers T1574.001.
4. H4 (high): A file matching a Kaspersky-published Umbrij / sideloaded-DLL hash executed or was written. Atomic.
5. H5 (high): A scheduled task named KasperskyEndpointSecurityEDRAvp was registered. Covers T1053.005 masquerade.
6. H6 (high): An Umbrij launcher ran with STRD switches (-regex + -deepsearch / -debugport / -browser). Command-line tell.
7. H7 (medium): A non-browser parent spawned a headless remote-debug browser. Catches renamed/unknown host binaries.
8. H8 (medium): A sideload host binary or headless browser resolved accounts.google.com for the OAuth code exchange. Covers T1114 / T1071.001.

Attack chain

All values published by Kaspersky Securelist. Hashes and sideloaded filenames are durable; the debug-port number is arbitrary (illustrative 11111). Validate against your own retention window before bulk-blocking, and note the host binaries are legitimate signed files abused only when they run from user-writable staging paths.

• Google Workspace Admin — Token audit: In the Admin console, review OAuth token grants and app activity for the migration apps Google Workspace Migration for Microsoft Outlook (client_id 279448736670) and Google Workspace Sync for Microsoft Outlook (1095133494869). Legitimate use is rare and admin-driven; unexpected grants tied to a workstation IP are the identity-side tell.
• Google Workspace — Login audit: Hunt for API access to Gmail from a localhost redirect flow or new device/session immediately after an endpoint alert; users can self-audit at myaccount.google.com/connections.
• Chrome/Edge policy state: Confirm DeveloperToolsAvailability is enforced (value 2 = disabled) via GPO/MDM reporting; any host where it is unset is exposed to STRD.
• Scheduled task inventory: Sweep for a task literally named KasperskyEndpointSecurityEDRAvp on hosts that do not run Kaspersky (the name is a masquerade).
• File-system sweep: Look for a BackupFiles directory under %LOCALAPPDATA%\Google\Chrome or %LOCALAPPDATA%\Microsoft\Edge — Umbrij's copied-profile staging folder.

Promotion path: validate the high-CONF/low-FP queries (Q1, Q3, Q5) against 7–14 days of baseline, confirm zero benign hits, then promote to Custom IOAs in detect mode; escalate Q3 to block once clean. Q4 hashes → Custom IOC Management (block).

One-click blocks for SOC tooling. Hashes are Kaspersky-published; swap expirations to fit your policy. Note the host EXEs are legitimate signed binaries — hunt on location/behaviour, do not blanket-block by name.

type,value,action,severity,expiration,description,tags
md5,1AB58838E5790EFB22F2D35AB98C0B7D,prevent,critical,2026-12-31,Umbrij ver.a,actor:ToddyCat;tool:Umbrij
md5,A7D7D6C4C3F227F7117261C63B9E23A9,prevent,critical,2026-12-31,Umbrij ver.a,actor:ToddyCat;tool:Umbrij
md5,3D3A621F852C42D97FD7260681E42508,prevent,critical,2026-12-31,Umbrij ver.a,actor:ToddyCat;tool:Umbrij
md5,3432DD9AC0DF80EF86EB80BD080F839B,prevent,critical,2026-12-31,Umbrij ver.a,actor:ToddyCat;tool:Umbrij
md5,22AAEB4946BA6D2F2E27FEB7DBB295DE,prevent,critical,2026-12-31,Umbrij ver.b,actor:ToddyCat;tool:Umbrij
md5,F61FBFB7AA1CD5DC8F70B055B51563E2,prevent,critical,2026-12-31,Umbrij ver.b,actor:ToddyCat;tool:Umbrij
md5,F169D6D172DFB775895A5E2B1540C854,prevent,critical,2026-12-31,Umbrij ver.c,actor:ToddyCat;tool:Umbrij
md5,9F5F2F0FB0A7F5AA9F16B9A7B6DAD89F,prevent,critical,2026-12-31,GoogleServices.DLL sideload,actor:ToddyCat;tool:Umbrij
md5,28CB7B261F4EB97E8A4B3B0D32F8DEF1,prevent,critical,2026-12-31,log.dll sideload,actor:ToddyCat;tool:Umbrij
md5,BAE82A15D1DBFB024617B9B56A8E5F66,prevent,critical,2026-12-31,VideoRecorderEngine.dll sideload,actor:ToddyCat;tool:Umbrij

[ Umbrij / STRD behaviors ]
- Browser launched with --headless AND --remote-debugging-port
- --user-data-dir pointing at a *\BackupFiles\* cloned profile
- GoogleDesktop.exe / BDSubWiz.exe / VSTestVideoRecorder.exe / bds.exe
  running from C:\Users\Public, C:\Windows\Vss, or C:\Windows\Temp
- Sideloaded DLL: GoogleServices.DLL / log.dll / VideoRecorderEngine.dll
- Launcher switches: -regex + -deepsearch / -debugport / -browser / -sync
- Scheduled task named KasperskyEndpointSecurityEDRAvp
- OAuth code exchange for client_id 279448736670 or 1095133494869
- Non-browser parent spawning a headless remote-debug Chrome/Edge

Actor:   ToddyCat (Asia-nexus espionage APT)
Implant: Umbrij (.NET DLL, ConfuserEx-obfuscated)
         Verdicts: HEUR:Trojan-PSW.MSIL.Umbrij.gen
                   HEUR:Trojan.MSIL.Agent.gen
Technique: STRD - Shadow Token via Remote Debug
Library:  PuppeteerSharp (Chrome DevTools Protocol)
OAuth:    GWMMO client_id 279448736670
          GWSMO client_id 1095133494869 (-sync)
Scopes:   mail.google.com, gmail.insert, gmail.labels,
          drive, admin.directory.user

[ ] Chrome/Edge policy DeveloperToolsAvailability = 2 (disabled) enforced
[ ] Workspace: restrict/deny GWMMO (279448736670) & GWSMO (1095133494869)
[ ] Workspace: review OAuth token grants + localhost-redirect API access
[ ] Scheduled-task sweep for KasperskyEndpointSecurityEDRAvp
[ ] WDAC/AppLocker blocks EXEs under C:\Users\Public, \Windows\Vss, \Windows\Temp
[ ] ASR: block credential stealing / LSASS + audit DLL side-loading hosts
[ ] Users audit third-party access at myaccount.google.com/connections

• Telemetry ready: Confirm ProcessRollup2, ScheduledTaskRegistered, PeFileWritten, and DnsRequest are flowing from in-scope Windows hosts running Chrome/Edge.
• Benign baseline: Run Q1 and Q7 (headless remote-debug) over 7–14 days; record any sanctioned Puppeteer/Playwright CI or QA hosts, and exclude those parents before alerting.
• Positive test: In a lab, launch chrome.exe --headless --remote-debugging-port=9222 --user-data-dir=C:\Temp\BackupFiles and confirm Q1 and Q2 fire; register a task named KasperskyEndpointSecurityEDRAvp and confirm Q5 fires.
• Promotion: Only promote Q1/Q3/Q5 to detect/block after zero benign hits across the baseline window.

P1 · Enforce Chrome DeveloperToolsAvailability = 2 (disable DevTools / remote debug)

# HKLM policy (applies to all users; Edge uses ...\Policies\Microsoft\Edge)
New-Item -Path 'HKLM:\SOFTWARE\Policies\Google\Chrome' -Force | Out-Null
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Google\Chrome' `
  -Name 'DeveloperToolsAvailability' -Type DWord -Value 2
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Edge' -Force | Out-Null
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Edge' `
  -Name 'DeveloperToolsAvailability' -Type DWord -Value 2
# Verify:
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Google\Chrome' -Name DeveloperToolsAvailability

P2 · Hunt the KasperskyEndpointSecurityEDRAvp scheduled task

$t = Get-ScheduledTask -TaskName 'KasperskyEndpointSecurityEDRAvp' -ErrorAction SilentlyContinue
if ($t) {
  $a = $t.Actions | Select-Object Execute, Arguments
  [pscustomobject]@{ Host=$env:COMPUTERNAME; Found=$true; Exec=$a.Execute; Args=$a.Arguments }
} else {
  [pscustomobject]@{ Host=$env:COMPUTERNAME; Found=$false }
}

P3 · Flag Chromium binaries / EXEs running from staging paths

$dirs = 'C:\Users\Public','C:\Windows\Vss','C:\Windows\Temp'
foreach ($d in $dirs) {
  if (Test-Path $d) {
    Get-ChildItem -Path $d -Filter *.exe -Recurse -ErrorAction SilentlyContinue |
      Where-Object { $_.Name -match '^(chrome|msedge|brave|chromium|GoogleDesktop|BDSubWiz|VSTestVideoRecorder|bds)\.exe$' } |
      Select-Object FullName, Length, LastWriteTime
  }
}

P4 · Locate cloned-profile BackupFiles staging folders

$roots = @(
  "$env:LOCALAPPDATA\Google\Chrome",
  "$env:LOCALAPPDATA\Microsoft\Edge"
)
foreach ($r in $roots) {
  if (Test-Path $r) {
    Get-ChildItem -Path $r -Directory -Filter 'BackupFiles' -ErrorAction SilentlyContinue |
      Select-Object FullName, CreationTime
  }
}

Detection is strongest at the STRD primitive (headless + remote-debug), DLL-sideload location, atomic hashes, and the masquerade task — all low-FP. The launcher-switch and non-browser-parent hunts need environment tuning for automation frameworks. The mailbox-read itself happens in Google's cloud and is a gap best covered upstream via Workspace token/login audit (§7).