A financially motivated threat actor known as Toy Ghouls has been identified using two newly developed Windows backdoors that leverage popular messaging and broker services for command-and-control communications.
The malware provides attackers with a stealthy method to execute commands, gather system information, and maintain long-term access to compromised machines. The shift is notable because the group previously depended largely on publicly available offensive tools and leaked ransomware builders.
Security researchers believe the introduction of custom malware reflects an effort to improve operational security, remain undetected for longer periods, and strengthen persistence within victim environments. Researchers at Kaspersky's Securelist first observed the activity in July 2026 and attributed it to Toy Ghouls, a threat group also tracked under the names Bearlyfy, Laboo.boo, and Feral Wolf. Active since at least 2025, the group has primarily targeted organizations in Russia and has previously been linked to the GenieLocker ransomware operation.
Custom Backdoors Enable Full Remote Access
The newly identified malware families, named mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0, are typically deployed after attackers have already gained initial access to a network. Their deployment demonstrates how an early-stage intrusion can evolve into a persistent compromise capable of supporting long-term attacker operations.
According to Kaspersky, both backdoors provide extensive control over infected Windows systems, allowing threat actors to remotely manage compromised devices and execute a wide range of malicious activities.
Abuse of Windows Remote Management
To deploy the backdoors, Toy Ghouls relies on Windows Remote Management (WinRM), a legitimate administration framework commonly used by IT teams. Attackers use tools such as Evil-WinRM and WinRM-fs to transfer files, execute commands, and establish remote control across Windows environments.
Because WinRM is widely utilized for legitimate system administration, malicious activity can easily blend into normal operational traffic, making detection more challenging without detailed monitoring and logging.
This approach mirrors previous incidents where attackers abused trusted remote-management tools and valid credentials to move deeper into enterprise networks while avoiding traditional security controls.
MQTT Service Used as a Command Channel
One variant of the malware communicates through the public MQTT broker service broker.hivemq.com.
The backdoor transmits device status information, including CPU utilization, available memory, and connectivity details, while retrieving instructions from operators. Received commands are then executed through hidden PowerShell processes running on the infected host.
By routing command traffic through a legitimate public messaging service, attackers can disguise malicious communications within normal internet activity. Similar techniques have appeared in previous malware campaigns, including the WailingCrab operation, which also leveraged MQTT for covert command-and-control communications.
Matrix-Based Infrastructure for Remote Control
The second malware variant uses an attacker-controlled Element server built on the Matrix communication protocol.
Compromised systems send status updates to designated Matrix chat rooms and receive commands from an account identified as panel-bot. Those instructions are then executed through the Windows command-line environment.
Both versions support interactive execution and can also install themselves as Windows services, allowing them to automatically restart following system reboots. This persistence mechanism ensures attackers can regain access even after their original remote session has been terminated.
Persistence Techniques and Evasion Measures
The malware stores configuration settings in a config.toml file and encrypts sensitive information using identifiers unique to the compromised device.
In the Matrix-based variant, configuration data is removed from disk after initial execution and transferred into the Windows Registry. This approach reduces forensic artifacts and makes the malware more difficult to detect during routine security investigations.
The use of encrypted configuration files and registry-based storage highlights the group's increasing focus on stealth and long-term persistence.
Recommended Defensive Measures
Organizations should review and restrict WinRM usage, allowing access only from approved administration systems. Security teams should also closely monitor for unusual PowerShell activity, especially remote executions originating from non-standard management hosts.
Additional indicators that may warrant investigation include:
- Unexpected Windows services named cplsupport or wtas
- Suspicious configuration files stored under ProgramData directories
- Unusual outbound communications involving MQTT or Matrix infrastructure
- Unauthorized use of remote-management tools and administrative credentials
Administrators should treat privileged remote-management credentials as critical assets and enforce strong authentication controls, including multi-factor authentication where possible.
Legitimate Services, Malicious Purpose
Researchers emphasize that neither MQTT nor Element/Matrix services are inherently malicious. Instead, the campaign demonstrates how threat actors increasingly repurpose trusted and widely used technologies to conceal malicious communications.
By abusing legitimate messaging infrastructure, Toy Ghouls can blend command traffic with routine network activity, collect system intelligence, maintain persistence, and retain control of compromised Windows devices while reducing the likelihood of detection.
The campaign serves as another reminder that defenders must look beyond ransomware indicators alone and actively search for stealthy backdoor activity that may signal a deeper and more persistent network intrusion.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
