Angry Birds: Toy Ghouls’ new toys
Kaspersky tracks ransomware group Toy Ghouls deploying new custom backdoors, mqtt-bird-agent and matrix-bird-agent, using HiveMQ MQTT and Element as C2 channels.
Kaspersky reports that Toy Ghouls (also known as Bearlyfy, Laboo.boo and Feral Wolf), a financially motivated group targeting Russian organizations since 2025, shifted from leaked Babuk and LockBit builders and public GitHub tools to its custom GenieLocker ransomware. In early July 2026 the group deployed two custom backdoors: mqtt-bird-agent 0.1.0 using the public HiveMQ MQTT broker as C2, and matrix-bird-agent 0.1.0 using the Element messenger. The backdoors are delivered via WinRM using Evil-WinRM and WinRM-fs, persist as Windows services, and encrypt their configuration with ChaCha20-Poly1305 keyed to the machine's MachineGuid registry value.
- Toy Ghouls (Bearlyfy, Laboo.boo, Feral Wolf) targets Russian organizations since 2025
- Group moved from leaked Babuk/LockBit builders to custom GenieLocker ransomware
- New backdoors: mqtt-bird-agent 0.1.0 (HiveMQ) and matrix-bird-agent 0.1.0 (Element)
- Delivered via WinRM with Evil-WinRM and WinRM-fs; persists as a Windows service
- Config encrypted with ChaCha20-Poly1305 bound to the machine's MachineGuid
- Products
- HiveMQEvil-WinRMWinRM-fsElement
- Threat actors
- Toy Ghouls
- Countries
- Russia
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | broker.hivemq.com | gin. The first version uses the public HiveMQ MQTT broker ( broker.hivemq.com ) as its C2 server. The free tier of this broker supports u |
| domain | element.tw | eir own Element server running on the Matrix protocol, meet.element[.]tw , as the C2 server. On this server, they created a room u |
| md5 | 7916c33688385525078bee504c90f359 | upport.exe ( BFADBEEE63A4F0BF19EC9DEB8FA58F58 ) wtass.exe ( 7916C33688385525078BEE504C90F359 ) config.toml Registry keys: HKLM\Software\synapse\Config\S |
| md5 | bfadbeee63a4f0bf19ec9deb8fa58f58 | t.Zapchast.abwo File names and MD5 hashes: cplsupport.exe ( BFADBEEE63A4F0BF19EC9DEB8FA58F58 ) wtass.exe ( 7916C33688385525078BEE504C90F359 ) config.tom |
From the original article
7 min read at securelist.com
Kaspersky GERT experts have discovered new backdoors used by the Toy Ghouls group. One version of the backdoor uses the HiveMQ MQTT broker as its command-and-control server; the other uses the Matrix-based Element messenger.
By Kaspersky GERT, Kaspersky Security Services · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.