Toy Ghouls Unveils New Backdoors Utilizing HiveMQ and Element for C2 Communication

Introduction

The cybersecurity landscape continues to evolve, with threat actors constantly adapting their tactics. One such group, known as Toy Ghouls (also referred to as Bearlyfy, Laboo.boo, and Feral Wolf), has been active since 2025, primarily targeting Russian organizations. Initially, they relied on publicly available tools from GitHub and leaked ransomware builders like Babuk and LockBit. However, by mid-2026, they had transitioned to using their own custom ransomware, GenieLocker, and began deploying a new backdoor for the first time. This backdoor, identified in two versions, utilizes the HiveMQ MQTT broker and the Element messenger for command and control (C2) communication, marking a significant evolution in their attack strategy. For a detailed analysis, refer to the research published by Kaspersky.

Technical Details

Delivery Mechanism

In their latest campaign, Toy Ghouls have employed Windows Remote Management (WinRM) to deliver their backdoors and configuration files to compromised systems. They utilize open-source tools such as Evil-WinRM and WinRM-fs to facilitate this process, showcasing their reliance on established methods to infiltrate target networks.

Installation and Persistence

The backdoor can operate within an interactive command-line session and establish persistence by installing itself as a Windows service. Depending on the version, it can be initiated with options like --install or install. The backdoor’s help output reveals various launch options, including the ability to specify a configuration file path and encrypt sensitive configuration fields using a machine-bound key.

For instance, the HiveMQ version of the backdoor, named mqtt-bird-agent 0.1.0, and the Element version, matrix-bird-agent 0.1.0, both look for a config.toml file in specific directories. If not found, they can accept a path specified by the user. This flexibility allows the attackers to adapt their approach based on the environment they are targeting.

Communication Protocols

Upon startup, both versions of the backdoor send a GET request to http://ip-api.com/json to ascertain the system’s public IP address and country of origin. The HiveMQ version connects to the public HiveMQ MQTT broker, while the Element version communicates through a custom Element server set up by the attackers. This dual approach allows them to collect telemetry from compromised systems and issue commands effectively.

• For the HiveMQ version, system status is sent via a POST request to the broker, formatted to include details such as online status, hostname, and timestamp.
• The Element version sends similar status messages but utilizes the Matrix protocol for communication, indicating a sophisticated understanding of various messaging frameworks.

Both versions support command execution via PowerShell, with results sent back to the C2 server in a structured format. This capability allows Toy Ghouls to maintain control over infected devices, executing commands and gathering system metrics at defined intervals.

Implications and Observations

The emergence of these backdoors signifies a notable shift in Toy Ghouls’ operational tactics. By moving away from publicly available tools to custom-built solutions, they are likely aiming to enhance their stealth and effectiveness. The use of unconventional communication channels, such as the HiveMQ broker and the Element messenger, suggests a strategic effort to evade detection and maintain persistence within compromised networks.

As the group continues to refine its methods, organizations must remain vigilant and proactive in their cybersecurity measures. The indicators of compromise associated with these backdoors, including specific registry keys and service names, should be monitored closely to mitigate potential threats.

Indicators of Compromise

Security solutions have identified several indicators associated with Toy Ghouls’ activities:

• HEUR:Backdoor.Win64.Suptoml.gen
• HEUR:Trojan.Script.Zapchast.conf
• Backdoor.Win64.Agent.smgdvy
• Trojan.Script.Zapchast.abwm
• Trojan.Win64.Agent.smgsfo
• Trojan.Script.Zapchast.abwo

Additionally, the following registry keys and service names are noteworthy:

• Registry Keys:
  • HKLMSoftwaresynapseConfigSealedConfig
  • HKLMSoftwareSynapseAgentmetrics_interval
• Service Names:
  • cplsupport (Problem Reports Control Panel)
  • wtas (Windows Telemetry Aggregator Service)

As Toy Ghouls continues to evolve, their activities serve as a reminder of the persistent threats facing organizations today. Continuous monitoring and adaptation of security strategies will be essential in countering such sophisticated attacks.