Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
Kaspersky details NightEagle, Hacking Cat, and Toy Ghouls targeting Russian enterprises with Exchange backdoors, Gorilla RAT, and destructive Monkey ransomware.
76
Threat actor
Toy Ghouls
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 4, 2026
- Last mentionedSep 16, 2026
Timeline
2 articles · newest firstAngry Birds: Toy Ghouls’ new toys
Kaspersky tracks ransomware group Toy Ghouls deploying new custom backdoors, mqtt-bird-agent and matrix-bird-agent, using HiveMQ MQTT and Element as C2 channels.
45
Related CVEs
by mentions- CVE-2019-0708100%9.8Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep)
- CVE-2021-26855100%9.1Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon)
- CVE-2020-0688100%8.8RCE in Microsoft Exchange Server from Shared Install-Time Validation Keys
- CVE-2026-4289771%6.1Cross-Site Scripting in Microsoft Exchange Server Actively Exploited by Laundry Bear
Appears with
- Kasperskyvendor · 2
- Ukrainian Cyber Alliancethreat actor · 1
- mqtt-bird-agentmalware · 1
- Microsoft Exchangeproduct · 1
- Cyber Anarchy Squadthreat actor · 1
- Gorilla RATmalware · 1
- GhostContainermalware · 1
- WinRM-fsproduct · 1
- Monkey ransomwaremalware · 1
- Evil-WinRMproduct · 1
- NightEaglethreat actor · 1
- GenieLockermalware · 1
- HiveMQorganization · 1
- matrix-bird-agentmalware · 1
- HiveMQproduct · 1
- Hacking Catthreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.