An evolving threat organization codenamed ToddyCat is actively targeting Microsoft Exchange mail servers throughout the Europe and Asia regions. ToddyCat first surfaced in December 2020 when threat actors compromised high-value Microsoft Exchange servers of three organizations in Taiwan and Vietnam. Once compromised, ToddyCat actors deployed a well-known China Copper web shell, ultimately leading to installation of the Samurai backdoor. The group has also deployed the Ninja Trojan, which allows multiple threat actors to control one machine at the same time. Additionally, these backdoors give threat actors the ability to avoid detection, execute arbitrary commands/code, and mask communications to command-and-control (C2) nodes via HTTP header manipulation. ToddyCat threat actors continue to compromise assets in this campaign in similar fashions with slightly varying versions of their backdoor programs. Another attack vector that ToddyCat actors are utilizing is through Telegram, infecting a desktop device through malicious loaders sent to the user in zip archives. Network administrators should continue to patch vulnerable servers to lessen the risk of threat actor compromise. CTIX will continue to monitor this campaign and provide additional updates accordingly.