Skip to content
Threat Feed
Subscribe

Actor

Toy Ghouls

2 briefs RSS
high threat

Toy Ghouls Deploying Custom HiveMQ and Matrix-Based Backdoors

The threat actor Toy Ghouls is using WinRM to deploy custom 'Bird' backdoors that utilize HiveMQ MQTT brokers and the Matrix protocol for C2, featuring machine-bound encrypted configurations.

Toy Ghouls backdoors persistence winrm c2 mqtt
1r 3t 1i
high threat

Toy Ghouls Deploying Custom GenieLocker Ransomware

The Toy Ghouls threat actor is deploying a custom ransomware family called GenieLocker against manufacturing organizations, utilizing compromised VPN credentials and legitimate system tools for lateral movement and encryption.

Windows +6 Toy Ghouls ransomware extortion manufacturing toy-ghouls
1r 4t 1i