ToddyCat Malware Compromises Microsoft Exchange Servers using ProxyLogon Vulnerability

Cybersecuritynews •Tushar Subhra Dutta • January 7, 2026

ToddyCat, a sophisticated cyber espionage group, has emerged as a persistent threat targeting high-profile organizations across multiple continents. The group began operations in December 2020 by compromising Microsoft Exchange servers in Taiwan and Vietnam using an unidentified vulnerability. However, their capabilities expanded significantly in February 2021 when they began exploiting the ProxyLogon vulnerability to target […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ToddyCat Malware Targets Microsoft Exchange Servers via ProxyLogon Vulnerability ToddyCat, a cyber espionage group, has been targeting Microsoft Exchange servers since December 2020. The group initially exploited an unidentified vulnerability but significantly ramped up its operations in February 2021 by leveraging the ProxyLogon vulnerability to compromise servers in various high-profile organizations across multiple continents. 3 sources 32

Extracted Entities

ToddyCat Malware Compromises Microsoft Exchange Servers using ProxyLogon Vulnerability

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (2)

Platforms (1)

Vulnerabilities (1)