ToyMaker Makes use of LAGTOY to Promote Entry to CACTUS Ransomware Gangs for Double Extortion

Apr 26, 2025Ravie LakshmananMalware / Vulnerability

Cybersecurity researchers have detailed the actions of an preliminary entry dealer (IAB) dubbed ToyMaker that has been noticed handing over entry to double extortion ransomware gangs like CACTUS.

The IAB has been assessed with medium confidence to be a financially motivated risk actor, scanning for weak methods and deploying a customized malware referred to as LAGTOY (aka HOLERUN).

“LAGTOY can be utilized to create reverse shells and execute instructions on contaminated endpoints,” Cisco Talos researchers Joey Chen, Asheer Malhotra, Ashley Shen, Vitor Ventura, and Brandon White mentioned.

The malware was first documented by Google-owned Mandiant in late March 2023, attributing its use to a risk actor it tracks as UNC961. The exercise cluster can also be identified by different names akin to Gold Melody and Prophet Spider.

The risk actor has been noticed leveraging an enormous arsenal of identified safety flaws in internet-facing functions to acquire preliminary entry, adopted by conducting reconnaissance, credential harvesting, and LAGTOY deployment inside a span of per week.

The attackers additionally open SSH connections to a distant host to obtain a forensics device referred to as Magnet RAM Seize to acquire a reminiscence dump of the machine in a probable try to collect the sufferer’s credentials.

LAGTOY is designed to contact a hard-coded command-and-control (C2) server to retrieve instructions for subsequent execution on the endpoint. It may be used to create processes and run instructions underneath specified customers with corresponding privileges, per Mandiant.

The malware can also be outfitted to course of three instructions from the C2 server with a Sleep interval of 11000 milliseconds between them.

“After a lull in exercise of roughly three weeks, we noticed the CACTUS ransomware group make its means into the sufferer enterprise utilizing credentials stolen by ToyMaker,” Talos mentioned.

“Based mostly on the comparatively quick dwell time, the dearth of information theft and the following handover to CACTUS, it’s unlikely that ToyMaker had any espionage-motivated ambitions or targets.”

Within the incident analyzed by Talos, the CACTUS ransomware associates are mentioned to have carried out reconnaissance and persistence actions of their very own previous to knowledge exfiltration and encryption. Additionally noticed are a number of strategies to arrange long-term entry utilizing OpenSSH, AnyDesk, and eHorus Agent.

“ToyMaker is a financially-motivated preliminary entry dealer (IAB) who acquires entry to high-value organizations after which transfers that entry to secondary risk actors who often monetize the entry through double extortion and ransomware deployment,” the corporate mentioned.