Toy Ghouls Deploying Custom HiveMQ and Matrix-Based Backdoors

Toy Ghouls (also known as Bearlyfy, Laboo.boo, and Feral Wolf) has pivoted from using publicly available malware builders to deploying custom backdoors designated as 'mqtt-bird-agent' and 'matrix-bird-agent'. Observed in early July 2026, these tools target Russian organizations and leverage legitimate infrastructure for command-and-control. The HiveMQ version uses the public MQTT broker (broker.hivemq.com), while the Element version utilizes the Matrix protocol to facilitate communication. Both versions employ sophisticated configuration management, using the ChaCha20-Poly1305 algorithm keyed against the Windows MachineGuid to bind sensitive C2 parameters to the infected host. The attackers favor living-off-the-land techniques for delivery, specifically utilizing Windows Remote Management (WinRM) to drop and execute these payloads. The group's transition to proprietary backdoors represents a significant increase in operational security and persistence capability.

Attack Chain

1. The attacker gains initial access and establishes a WinRM session to the target system.
2. The attacker uses Evil-WinRM or WinRM-fs to upload the backdoor executable (e.g., cplsupport.exe or wtass.exe) and an associated config.toml file.
3. The backdoor is executed via command-line, performing a callback to http://ip-api.com to resolve the host's public IP and country.
4. The backdoor reads the configuration file; if unencrypted, it uses the HKLM\Software\Microsoft\Cryptography\MachineGuid to generate a key for ChaCha20-Poly1305 encryption of the config.
5. The backdoor is installed as a Windows service for persistence using the --install or install command-line options.
6. Configuration parameters are stored in either %PROGRAMDATA% (HiveMQ version) or the registry key HKLM\Software\synapse\Config\SealedConfig (Element version).
7. The backdoor initiates C2 communication, connecting to either the HiveMQ broker (broker.hivemq.com) or the attacker-controlled Matrix homeserver for tasking.
8. The final objective involves C2-driven task execution for lateral movement, data exfiltration, or further malware deployment.

Impact

Successful deployment of these backdoors grants the attackers persistent, interactive access to compromised hosts. The use of machine-bound encryption complicates security analysis and prevents the reuse of stolen configuration files across different environments. Organizations targeted by Toy Ghouls face high risks of sensitive data exfiltration and the subsequent deployment of custom ransomware, such as GenieLocker.

Recommendation

• Deploy the Sigma rule below to detect unauthorized service installations of the 'Bird' backdoors.
• Monitor for network connections to broker.hivemq.com and traffic patterns associated with the Matrix protocol from non-standard endpoints.
• Restrict WinRM access to only known administrative management hosts and monitor for the usage of tools like Evil-WinRM.
• Baseline Registry modifications to HKLM\Software\synapse\Config\SealedConfig.