New Backdoors from Toy Ghouls
New Backdoors from Toy Ghouls 🚨
We continue tracking the activity of Toy Ghouls (also known as Bearlyfy, Laboo.boo, and Feral Wolf), a financially motivated group that has been targeting Russian organizations since 2025. The attackers initially relied exclusively on tools pulled from public GitHub repositories along with leaked Babuk and LockBit ransomware builders, later shifting to their own custom ransomware, GenieLocker. In early July 2026, we observed the group using a custom backdoor for the first time. We identified two versions of this backdoor: one uses the HiveMQ MQTT broker as its C2 server, while the other relies on the Element messenger. Both versions include “bird” in their names: mqtt-bird-agent 0.1.0 (HiveMQ version) and matrix-bird-agent 0.1.0 (Element version).
In this campaign, the attackers use Windows Remote Management (WinRM) to deliver the backdoors and their configuration files to compromised systems. The group relies on open-source tools such as Evil-WinRM and WinRM-fs to do this. The backdoor can both run within an interactive command-line session and establish persistence as a Windows service, using the --install or install option, depending on the backdoor version. By default, the backdoor looks for a config.toml configuration file in the directory where the executable was launched, then falls back to %PROGRAMDATA%\SynapseAgent\config.toml (Element version) or %PROGRAMDATA%\cplsupport\config.toml (HiveMQ version). The backdoor accepts both unencrypted configuration files and files with partially encrypted sections. In the first case, once the backdoor is launched, it reads the file and partially encrypts it using the seal() function, applying the ChaCha20-Poly1305 algorithm with a key derived from the value of the HKLM\Software\Microsoft\Cryptography\MachineGuid registry key. This means that after the backdoor’s first run, the configuration file becomes bound to that specific machine. In the Element version, the configuration file is deleted immediately after the first run, and the relevant parameters are instead written to the HKLM\Software\synapse\Config\SealedConfig registry key.
At startup, both backdoor versions send a GET request to https://ip-api.com/json to determine the system’s public IP address and country of origin. The first version uses the public HiveMQ MQTT broker as its C2 server. Attackers set up their own cluster and used it both to collect telemetry from compromised systems and to send commands to the backdoor. Commands are executed via PowerShell.exe in hidden mode, using the -NonInteractive -NoProfile -Command parameters. For the second backdoor version, the attackers set up their own Element server running on the Matrix protocol as the C2 server. On this server, they created a room used to receive messages containing device information and to send commands for execution on the compromised system. Received commands are executed via the Windows command line interface. Based on data extracted from Element’s SQLite databases on the compromised system, we were able to identify the account name the attackers used to send commands: panel-bot.
We have been tracking Toy Ghouls’ activity for quite some time. We previously found that the group had expanded its arsenal with a custom ransomware strain, GenieLocker, and we have now discovered that it has also developed a backdoor capable of giving it full control over an infected device. The new tools use unconventional channels to communicate with their C2 server: the HiveMQ MQTT broker and the Matrix-based Element messenger. This shift away from publicly available open-source projects toward custom-built tools suggests that Toy Ghouls is working to make its attacks more sophisticated and to evade detection for longer. Kaspersky security solution verdicts include HEUR:Backdoor.Win64.Suptoml.gen and Backdoor.Win64.Agent.smgdvy. Key file names are cplsupport.exe and wtass.exe. Noteworthy domain names include meet.element and broker.hive.
To read the complete article see: Read full article