F FEICELL News全球新闻 · 本地动态 · 实时更新
← 返回新闻首页
网络安全研究机构

Angry Birds: Toy Ghouls’ new toys

Kaspersky GERT experts have discovered new backdoors used by the Toy Ghouls group. One version of the backdoor uses the HiveMQ MQTT broker as its command-and-control server; the other uses the Matrix-based Element messenger.

SecurelistKaspersky GERT, Kaspersky Security Services查看原文 ↗
愤怒的小鸟：玩具总动员的新玩具

SOC, TI and IR posts

Kaspersky Security Services

Indicators of compromise

We continue tracking the activity of Toy Ghouls (also known as Bearlyfy, Laboo.boo, and Feral Wolf), a financially motivated group that has been targeting Russian organizations since 2025. The attackers initially relied exclusively on tools pulled from public GitHub repositories along with leaked Babuk and LockBit ransomware builders, later shifting to their own custom ransomware, GenieLocker . In early July 2026, we observed the group using a custom backdoor for the first time.

We identified two versions of this backdoor: one uses the HiveMQ MQTT broker as its C2 server, while the other relies on the Element messenger. Both versions include “bird” in their names:

mqtt-bird-agent 0.1.0 (HiveMQ version)

matrix-bird-agent 0.1.0 (Element version)

This post examines how the backdoor is delivered to target systems, how it establishes persistence, and how it communicates with its C2 server.

In this campaign, the attackers use Windows Remote Management (WinRM) to deliver the backdoors and their configuration files to compromised systems. The group relies on open-source tools such as Evil-WinRM and WinRM-fs to do this.

The backdoor can both run within an interactive command-line session and establish persistence as a Windows service, using the --install or install option, depending on the backdoor version. The --service (or service ) option is not available by default and is instead used as an argument for the installed Windows service.

Other launch options are listed in the backdoor’s help output:

HiveMQ version backdoor help output

In the Element version, the backdoor help output looks as follows:

Element version backdoor help output

By default, the backdoor looks for a config.toml configuration file in the directory where the executable was launched, then falls back to %PROGRAMDATA%\SynapseAgent\config.toml (Element version) or %PROGRAMDATA%\cplsupport\config.toml (HiveMQ version). If no configuration file is found in either location, the full path can be specified using the -c (--config) option.

The backdoor accepts both unencrypted configuration files and files with partially encrypted sections. In the first case, once the backdoor is launched, it reads the file and partially encrypts it using the seal() function (the --seal option in the HiveMQ version), applying the ChaCha20-Poly1305 algorithm with a key derived from the value of the HKLM\Software\Microsoft\Cryptography\MachineGuid registry key. This means that after the backdoor’s first run, the configuration file becomes bound to that specific machine. On subsequent runs, the configuration is decrypted automatically. If the input configuration was already partially encrypted, it is likewise decrypted automatically.

If the configuration cannot be decrypted, the backdoor stops running.

Encrypted configuration files look as follows:

Encrypted backdoor configuration file, HiveMQ version

The encrypted portion of the HiveMQ version’s configuration contains the following parameters:

agent_privkey : the agent’s private key

channel_id : the channel identifier used to communicate with the broker

server_pubkey : the server’s public key

Decrypted blob field in the HiveMQ version’s configuration

In the Element version, the configuration file is deleted immediately after the first run, and the relevant parameters are instead written to the HKLM\Software\synapse\Config\SealedConfig registry key. On subsequent runs, the backdoor checks the registry for its configuration first.

Decrypted Element version configuration file, retrieved from the registry

The Element version’s configuration specifies the address of an Element server controlled by the attackers, a room identifier, and an access_token used to access that room. If this parameter is left empty, the backdoor prompts for the password interactively during installation. After successfully creating a session, the backdoor saves the received token to the blob field.

At startup, both backdoor versions send a GET request to http://ip-api.com/json to determine the system’s public IP address and country of origin.

The first version uses the public HiveMQ MQTT broker ( broker.hivemq.com ) as its C2 server. The free tier of this broker supports up to 100 concurrent connections and up to 10 GB of traffic per month. The attackers set up their own cluster and used it both to collect telemetry from compromised systems and to send commands to the backdoor.

Once a connection is established, the system’s status is sent via a POST request to broker . hivemq . com : 8883 / [ cluster_id ] / status . The message format is: { "online" : bool , "hostname" : "hostname.domain" , "timestamp" : unix_timestamp , "location" : { "json" } } .

At intervals defined in the configuration file, system information, such as CPU load and available memory, is sent via a POST request to broker . hivemq . com : 8883 / [ cluster_id ] / metrics3 . The message format is: { cpu _ percent ":float," mem_used _ bytes ":int," mem_total _ bytes ":int," disk_used _ bytes ":int," disk_total _ bytes ":int," load _ 1m ":float," load _ 5m ":float," load _ 15m ":float," uptime _ secs ":int," hostname ":" hostname . domain "," timestamp " : unix_timestamp } .

The backdoor sends GET requests to broker . hivemq . com : 8883 / [ cluster_id ] / cmd / req to retrieve commands from the C2 server. The server responds in the format: { "cmd_id" : int , "command" : "str" , "timeout_secs" : int } .

Commands are executed via PowerShell.exe in hidden mode, using the -NonInteractive -NoProfile -Command parameters.

Command execution results are sent to the command server at broker . hivemq . com : 8883 / [ cluster_id ] / cmd / res in the { "stdout" : "str" , "stderr" : "str" , "exit_code" : int , "duration_ms" : int } format.

For the second backdoor version, the attackers set up their own Element server running on the Matrix protocol, meet.element[.]tw , as the C2 server. On this server, they created a room used to receive messages containing device information and to send commands for execution on the compromised system. The communication flow is as follows:

Once a connection is successfully established, the backdoor sends an m.bird.status message containing the system’s status. This message format is identical to that used in the HiveMQ version.

At intervals defined in the configuration file, information about the compromised system is sent as an m.bird.metrics message. Field names are slightly different from those in the first version: { cpu_percent _ x100 ":float," mem_used _ bytes ":int," mem_total _ bytes ":int," disk_used _ bytes ":int," disk_total _ bytes ":int," load_1m _ x100 ":float," load_5m _ x100 ":float," load_15m _ x100 ":float," uptime _ secs ":int," hostname ":" hostname . domain "," timestamp " : unix_timestamp } .

This version of the backdoor supports two types of commands, distinguished by the start of the received message. To set a new interval for sending metrics, the attackers send a message beginning with config:set_interval (accepting values from 5 to 3600 seconds). The new value is saved to the HKLM\Software\SynapseAgent\metrics_interval registry key. Messages containing commands to execute begin with the string cmd: . Based on data extracted from Element’s SQLite databases on the compromised system, we were able to identify the account name the attackers used to send commands: panel-bot .

To set a new interval for sending metrics, the attackers send a message beginning with config:set_interval (accepting values from 5 to 3600 seconds). The new value is saved to the HKLM\Software\SynapseAgent\metrics_interval registry key.

Messages containing commands to execute begin with the string cmd: . Based on data extracted from Element’s SQLite databases on the compromised system, we were able to identify the account name the attackers used to send commands: panel-bot .

Received commands are executed via the Windows command line interface.

Command output is sent as an m.bird.cmd_response message. This message format mirrors the one used in the HiveMQ version.

We have been tracking Toy Ghouls’ activity for quite some time. We previously found that the group had expanded its arsenal with a custom ransomware strain, GenieLocker, and we have now discovered that it has also developed a backdoor capable of giving it full control over an infected device. The new tools use unconventional channels to communicate with their C2 server: the HiveMQ MQTT broker and the Matrix-based Element messenger. This shift away from publicly available open-source projects toward custom-built tools suggests that Toy Ghouls is working to make its attacks more sophisticated and to evade detection for longer.

Kaspersky security solution verdicts:

HEUR:Backdoor.Win64.Suptoml.gen

HEUR:Trojan.Script.Zapchast.conf

Backdoor.Win64.Agent.smgdvy

Trojan.Script.Zapchast.abwm

Trojan.Win64.Agent.smgsfo

Trojan.Script.Zapchast.abwo

File names and MD5 hashes:

cplsupport.exe ( BFADBEEE63A4F0BF19EC9DEB8FA58F58 )

wtass.exe ( 7916C33688385525078BEE504C90F359 )

HKLM\Software\synapse\Config\SealedConfig

HKLM\Software\SynapseAgent\metrics_interval

cplsupport (Problem Reports Control Panel)

wtas (Windows Telemetry Aggregator Service)

broker.hivemq.com (a legitimate resource used by cybercriminals)

ip-api.com (a legitimate resource used by cybercriminals)

Malware Technologies

Malware Descriptions

Angry Birds: Toy Ghouls’ new toys

This site uses Akismet to reduce spam. Learn how your comment data is processed.

From the same authors

Anatomy of a Cyber World Global Report 2026

Goodbye, dark Telegram: Blocks are pushing the underground out

Inside the dark web job market

Signal in the noise: what hashtags reveal about hacktivism in 2025

Incident response analyst report 2024

In the same category

An analysis of incidents at Brazilian educational institutions

Risk reduction redefined: How compromise assessment helps strengthen cyberdefenses

Whispers from the Dark Web Cave. Cyberthreats in the Middle East

A deep dive into the most interesting incident response cases of last year

Tusk: unraveling a complex infostealer campaign

手机左右滑动，电脑按 ← → 键，也能切换新闻