ToyMaker deploys LAGTOY malware to steal credentials and sell access to CACTUS ransomware groups for double extortion.

The web shells grant the threat actor the ability to execute arbitrary commands in system context, with the privileges of the ...