Toy Ghouls Deploys New Backdoors Using HiveMQ and Element for C2
Financially motivated threat group Toy Ghouls is leveraging custom backdoors that utilize HiveMQ MQTT or Element messenger for command and control, delivered via WinRM.
The financially motivated threat group Toy Ghouls, also tracked under aliases such as Bearlyfy, Laboo.boo, and Feral Wolf, has been actively targeting Russian organizations since 2025. Initially relying on publicly available tools and leaked ransomware builders, the group evolved to develop its own custom ransomware, GenieLocker. In a recent development observed in early July 2026, Toy Ghouls has begun deploying new custom backdoors, marking a significant shift in their operational tactics.
Security researchers have identified two distinct versions of this new backdoor. One variant, named mqtt-bird-agent 0.1.0, utilizes the HiveMQ MQTT broker for its command and control (C2) infrastructure. The second variant, matrix-bird-agent 0.1.0, leverages the Element messenger for C2 communication. Both backdoors incorporate "bird" into their naming convention, suggesting a common development lineage or operational theme.
The delivery mechanism for these backdoors involves the exploitation of Windows Remote Management (WinRM). Attackers are employing open-source tools like Evil-WinRM and WinRM-fs to gain initial access and deploy the malicious payloads onto compromised systems. This method allows for lateral movement and the execution of commands across the network without requiring direct user interaction on the target machines.
Once deployed, the backdoors are capable of establishing persistence on the victim's system. They can operate within an interactive command-line session or, more stealthily, install themselves as a Windows service. This persistence mechanism ensures that the backdoor remains active even after a system reboot. The installation process can be initiated using specific command-line arguments, such as --install or install, depending on the backdoor version.
Configuration files are crucial for the operation of these backdoors. They are designed to be machine-bound and are encrypted using the ChaCha20-Poly1305 algorithm. The encryption key is derived from the unique MachineGuid registry key of the compromised system, ensuring that the configuration is specific to that particular machine. This binding prevents the configuration from being easily reused on other systems.
Both backdoor versions communicate with their respective C2 servers by first determining the system's public IP address and country of origin using an external API. The HiveMQ version connects to the public HiveMQ MQTT broker, while the Element version communicates through a dedicated Element server. The backdoors send system status and performance metrics, such as CPU load and memory usage, to the C2 infrastructure at configurable intervals.
The use of HiveMQ MQTT and Element messenger for C2 represents a notable adaptation by Toy Ghouls. MQTT is a lightweight messaging protocol often used in IoT devices and industrial systems, while Element is an encrypted messaging platform. By employing these less conventional C2 channels, the threat group likely aims to evade detection by traditional security monitoring tools that may not be specifically configured to inspect traffic on these protocols or platforms.
This evolution in Toy Ghouls' toolkit, particularly the adoption of custom backdoors with flexible C2 options and machine-bound encryption, highlights the group's increasing sophistication and their commitment to maintaining persistent access to their targets for financial gain. The deployment of these new backdoors underscores the ongoing threat posed by financially motivated cybercriminal groups and the need for organizations to remain vigilant against evolving attack vectors.