Search: “Babuk”

Angry Birds: Toy Ghouls’ new toys

Kaspersky tracks ransomware group Toy Ghouls deploying new custom backdoors, mqtt-bird-agent and matrix-bird-agent, using HiveMQ MQTT and Element as C2 channels.

Kaspersky reports that Toy Ghouls (also known as Bearlyfy, Laboo.boo and Feral Wolf), a financially motivated group targeting Russian organizations since 2025, shifted from leaked Babuk and LockBit builders and public GitHub tools to its custom GenieLocker ransomware. In early July 2026 the group deployed two custom backdoors: mqtt-bird-agent 0.1.0 using the public HiveMQ MQTT broker as C2, and matrix-bird-agent 0.1.0 using the Element messenger. The backdoors are delivered via WinRM using Evil-WinRM and WinRM-fs, persist as Windows services, and encrypt their configuration with ChaCha20-Poly1305 keyed to the machine's MachineGuid registry value.

Kaspersky Securelist·Sep 4, 10:00 UTC · 12d agoThreat actor

New pro-Ukraine hacker group targets Russian companies with custom ransomware

F6 links new pro-Ukraine ransomware group VantaCore, likely a Thor rebrand, to seven attacks on Russian firms using custom tooling and multimillion-dollar demands.

Russian cybersecurity firm F6 reports that VantaCore, a ransomware group believed to be a rebrand of pro-Ukrainian group Thor, has targeted at least seven Russian organizations with ransom demands reaching millions of dollars, operating as a ransomware-as-a-service operation with a Tor-based victim chat and a leak site. The group uses custom-built tooling including the VantaCore ransomware that encrypts servers and workstations, VantaCoreLoader for distribution, the VantaCoreRAT backdoor, and SnowKiller, which disables antivirus and security software. Initial access relies on poorly secured VPNs and remote-access tools, flaws in internet-facing applications, and credentials stolen from business partners. F6 notes pro-Ukrainian groups increasingly abandoned stock ransomware like LockBit 3 Black and Babuk in 2025-2026 in favor of custom malware.

The Record·Sep 2, 15:11 UTC · 13d agoRansomware

C.A.S hacktivists attack Russian organizations using rare RATs

Kaspersky Securelist·Dec 18, 10:00 UTC · Dec 18, 2024Exploit / PoC