Press play to start listening
A cybercrime group targeting Russian organizations has begun using custom Windows backdoors that send command traffic through two legitimate communication services. One version uses HiveMQ, an MQTT broker that relays messages between connected devices. The second communicates through an attacker-controlled server using Element, a messaging platform built on the Matrix protocol.
Researchers from Kaspersky GERT first observed the custom malware in early July 2026, according to a Securelist report published on September 4. The financially motivated group, known as Toy Ghouls, Bearlyfy, Laboo.boo, and Feral Wolf, has targeted Russian organizations since 2025. Kaspersky did not identify the affected organizations or state how many systems were compromised.
From Ransomware Builders to Custom Malware
Earlier Toy Ghouls operations used tools obtained from public GitHub repositories, along with leaked builders for the Babuk and LockBit ransomware families. The group later developed GenieLocker, its own ransomware, before adding the newly documented backdoors to its toolset.
Both backdoor versions carry “bird” in their internal names. The HiveMQ edition is called mqtt-bird-agent 0.1.0, while the Element edition is identified as matrix-bird-agent 0.1.0. Each can run from an interactive command session or install itself as a Windows service for continued access.
Once active, the malware contacts ip-api.com to obtain the computer’s public IP address and country. It also gathers operational information, including the hostname, processor load, memory and disk usage, system uptime, and timestamps. Operators can then issue commands and receive the results from the infected computer.
Delivery Through Windows Remote Management
Kaspersky observed the attackers transferring the backdoors and their configuration files through Windows Remote Management. They used the open-source Evil-WinRM and WinRM-fs tools during this stage.
The report describes delivery to systems that had already been compromised, so WinRM should not be presented as the method used to gain initial entry. Kaspersky did not disclose how the attackers first obtained access to the affected networks.
After installation, the malware uses service names designed to resemble Windows components. The HiveMQ version registers as cplsupport, with the display name “Problem Reports Control Panel.” The Element version uses wtas, displayed as “Windows Telemetry Aggregator Service.”
Two Routes for Command Traffic
With the first version, Toy Ghouls used MQTT, a lightweight protocol normally used to pass short messages between connected devices. The backdoor connected to the public HiveMQ broker at broker.hivemq.com, where it reported when a computer was online, sent performance data, collected commands and returned the results. It executed those commands through PowerShell with the window hidden and user interaction disabled.
For the second version, Toy Ghouls set up an Element server at meet.elementtw and created a Matrix room for communicating with infected computers. The backdoor waited for messages beginning with cmd:, ran the supplied instructions through the Windows command line and sent the output back to the room. Kaspersky found that the commands came from an account named panel-bot.
Toy Ghouls also made each backdoor’s sensitive configuration specific to the computer on which it was installed. The malware encrypted selected fields with ChaCha20-Poly1305 using a key derived from the Windows MachineGuid. After its first run, the Element version deleted the original configuration file and saved the encrypted settings in the Windows Registry.
Neither HiveMQ nor Element was reported as breached. Toy Ghouls used HiveMQ’s legitimate public broker and operated its own Element server, allowing malicious commands to travel through technology that also supports normal business activity.
The custom backdoors give the group a direct method for monitoring infected computers and executing commands. Their appearance also shows Toy Ghouls investing in privately developed malware after earlier campaigns used publicly available tools and leaked ransomware builders.
