Toy Ghouls Deploys New Backdoors Using HiveMQ and Element for Stealthy C2

Kaspersky researchers have uncovered two new custom backdoors used by the financially motivated Toy Ghouls cybercrime group, revealing a shift toward purpose-built malware and unconventional command-and-control infrastructure.

The two backdoors, named mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0, use different communication mechanisms. The first relies on the HiveMQ MQTT broker, while the second communicates through the Matrix-based Element messenger.

Kaspersky's investigation found that the malware can establish persistence on Windows systems, collect system information and receive commands from attackers. The group has reportedly been targeting Russian organisations since 2025.

Toy Ghouls Moves Beyond Publicly Available Tools

Toy Ghouls, also known as Bearlyfy, Laboo.boo and Feral Wolf, has previously relied heavily on publicly available tools and leaked ransomware builders.

According to Kaspersky, the group later moved towards its own ransomware, including the custom GenieLocker strain. In early July 2026, researchers observed Toy Ghouls using a custom backdoor for the first time.

The discovery of these two new backdoors is significant because it indicates that the group is increasingly developing tools specifically suited to its operations.

Rather than depending exclusively on conventional malware communication mechanisms, Toy Ghouls has incorporated legitimate communication technologies into its command infrastructure.

The two backdoors at a glance

Both tools are designed for Windows environments and support persistent operation as Windows services.

WinRM Used for Delivery

Kaspersky says the backdoors and their configuration files were delivered to compromised systems through Windows Remote Management (WinRM).

The attackers used open-source tools including Evil-WinRM and WinRM-fs as part of this process.

This means the initial delivery mechanism does not necessarily depend on a traditional malware installer. Instead, the attackers can use remote administration functionality to move the backdoor and its configuration into an already compromised Windows environment.

For defenders, this highlights why legitimate administrative protocols can become important signals during incident investigations.

Persistence Through Windows Services

Both backdoor variants can operate interactively from the command line, but they can also install themselves as Windows services.

The HiveMQ variant uses options such as --install, while the Element version provides an install command.

Once installed, the malware can run through a Windows service rather than requiring an attacker to manually launch the executable each time.

Kaspersky identified the following service names:

• cplsupport

• wtas

The names are designed to resemble legitimate Windows functionality, which can make superficial service-name inspection less reliable.

Configuration Files Are Protected Against Analysis

The backdoors also implement mechanisms for protecting their configuration data.

The HiveMQ version can partially encrypt sensitive configuration fields using ChaCha20-Poly1305. The encryption key is derived from the Windows MachineGuid registry value.

This creates a machine-bound configuration. After the backdoor runs, the configuration is associated with the specific system where it was processed.

The protected HiveMQ configuration contains information including:

• Agent private key

• Channel identifier

• Server public key

The Element version takes a different approach.

After its first execution, the original configuration file is deleted and relevant information is stored in the Windows registry under:

HKLM\Software\synapse\Config\SealedConfig

This configuration contains the attacker's Element server address, room identifier and access token.

HiveMQ Turns MQTT Infrastructure Into a C2 Channel

The first backdoor uses the public HiveMQ MQTT broker, specifically broker.hivemq.com, as its C2 infrastructure.

MQTT is a messaging protocol commonly associated with connected devices and other systems that require lightweight message delivery. In this case, Toy Ghouls uses the technology to communicate with compromised Windows machines.

Kaspersky found that the attackers established their own cluster and used the infrastructure to collect telemetry and send commands to infected systems.

When the malware connects, it sends information about the compromised machine.

The collected status information includes details such as:

• Hostname

• Timestamp

• Online status

• Public IP-related location information

The malware also periodically reports system metrics, including CPU load, memory usage, disk usage, system load and uptime.

The backdoor then checks the C2 infrastructure for commands.

Commands retrieved from the server are executed using PowerShell.exe in hidden mode. Results are subsequently sent back to the command infrastructure.

Element Messenger Becomes the Second C2 Channel

The second backdoor takes a different approach.

Instead of MQTT, matrix-bird-agent uses the Matrix protocol through an attacker-controlled Element server.

Kaspersky identified the server as:

meet.element[.]tw

The attackers created a Matrix room where the malware could send system information and receive commands.

This gives the backdoor a messaging-oriented command channel rather than a conventional malware-specific C2 protocol.

The malware sends status information through messages such as m.bird.status and periodic metrics through m.bird.metrics.

The attackers can also change the interval at which the malware sends system metrics.

Commands begin with a specific cmd: prefix and are executed through the Windows command-line interface.

Kaspersky also identified the attacker account used to send commands as panel-bot based on analysis of Element's local SQLite databases.

Why the C2 Strategy Matters

The most notable aspect of the campaign is not simply that Toy Ghouls created another backdoor. It is the way the group has designed its communication infrastructure.

Traditional malware C2 infrastructure can sometimes provide defenders with recognisable indicators such as dedicated domains, unusual protocols or known server infrastructure.

Using established communication technologies introduces a different challenge.

The HiveMQ version communicates through an MQTT broker, while the Element version operates through Matrix messaging infrastructure. Both technologies have legitimate uses outside malicious activity.

This does not make the communication invisible, but it can make detection more dependent on context.

For security teams, the focus therefore needs to extend beyond simply asking whether an organisation is communicating with a legitimate service.

Questions can include:

• Is the communication expected for that endpoint?

• Is MQTT normally used within the environment?

• Why is a Windows workstation communicating with a particular broker?

• Are unusual Matrix or Element connections appearing on enterprise systems?

• Are newly created Windows services associated with unexpected binaries?

• Are WinRM sessions being used outside normal administrative workflows?

• Are PowerShell processes being launched by unfamiliar services?

The announcement does not provide specific information about Toy Ghouls' overall detection rate or the number of organisations affected by these particular backdoors.

A Shift Toward Custom Malware

Kaspersky's findings point to a broader change in Toy Ghouls' toolkit.

The group initially relied heavily on publicly available tools and leaked ransomware builders. It later developed GenieLocker ransomware and has now been observed using custom backdoors with dedicated communication mechanisms.

This evolution matters because custom tooling can be designed around the operational requirements of a specific threat actor.

In this case, the backdoors combine:

• Remote delivery through WinRM

• Windows service persistence

• Protected configuration data

• System telemetry

• Remote command execution

• MQTT-based C2

• Matrix-based C2

The combination provides attackers with a complete mechanism for maintaining control of compromised systems.

What Security Teams Should Watch

Organisations defending Windows environments should pay particular attention to unusual combinations of administrative activity and persistence.

Potential investigation areas include:

1. Unexpected Windows services

Look for newly registered services, particularly those using unfamiliar binaries or names that imitate legitimate Windows components.

2. WinRM activity

Review WinRM authentication and remote execution activity that falls outside established administrative patterns.

3. Unusual MQTT traffic

Investigate enterprise Windows systems that unexpectedly communicate with public MQTT infrastructure.

4. Matrix and Element traffic

Monitor for unexpected connections to Matrix or Element infrastructure from endpoints where such communication is not part of normal business activity.

5. PowerShell execution

Correlate hidden or unusual PowerShell activity with newly installed services and remote management sessions.

6. Registry persistence and configuration

Review suspicious registry locations, especially where they are associated with recently installed services or unknown executables.

Indicators of Compromise

Kaspersky published several indicators associated with the campaign.

File names:

• cplsupport.exe

• wtass.exe

• config.toml

Service names:

• cplsupport

• wtas

Registry keys:

• HKLM\Software\synapse\Config\SealedConfig

• HKLM\Software\SynapseAgent\metrics_interval

Domains:

• meet.element[.]tw

• broker.hivemq.com

• ip-api.com

Kaspersky also published MD5 hashes for the identified executables and antivirus detection names in its technical analysis.

Security teams should treat these indicators as part of a broader investigation rather than relying on individual indicators in isolation.

The Bigger Cybersecurity Picture

The Toy Ghouls campaign highlights an increasingly important challenge for defenders: malicious activity can operate through technologies that were not originally designed for malware.

MQTT brokers and Matrix messaging infrastructure have legitimate applications. Their presence alone therefore does not establish compromise.

The security signal comes from the combination of endpoint behaviour, persistence, process execution, network activity and communication patterns.

The announcement highlights a broader industry shift toward threat actors developing customised infrastructure instead of depending exclusively on commodity malware and publicly available tools.

For enterprises, this could mean greater emphasis on behavioural detection, endpoint telemetry and correlation across network and host-level events.

Toy Ghouls' latest backdoors also demonstrate why legitimate infrastructure should not automatically be considered trustworthy simply because the underlying technology is widely used.

Conclusion

Kaspersky's discovery of mqtt-bird-agent and matrix-bird-agent provides another look at how Toy Ghouls is expanding its operational toolkit.

The two backdoors share a common purpose but use different C2 mechanisms. One communicates through HiveMQ's MQTT infrastructure, while the other uses an attacker-controlled Matrix server through Element.

Both can establish persistence as Windows services, collect system information and execute commands remotely.

The most important defensive lesson is that C2 detection cannot rely solely on obviously malicious infrastructure.

Unexpected WinRM activity, suspicious Windows services, abnormal PowerShell execution and unexplained communication with MQTT or Matrix infrastructure can become valuable investigation signals when analysed together.

Kaspersky's research shows that Toy Ghouls is continuing to move towards custom-built tooling. Additional details about the full scope of infections associated with these two backdoors were not disclosed in the announcement.