Fast Facts
- Toy Ghouls has developed sophisticated custom backdoors that communicate via MQTT and the Matrix protocol, evading detection by using unconventional channels.
- The group employs WinRM for remote delivery and persistence, executing commands hidden within PowerShell and leveraging registry-based configuration files.
- Their malware infrastructure includes unique indicators like specific registry keys, service names, and domain names such as meet.element[.]tw and broker.hivemq.com, which facilitate ongoing command and control.
Threat Overview, Attack Techniques, and Targets
Toy Ghouls, also known as Bearlyfy, Laboo.boo, and Feral Wolf, are financially motivated actors. They have targeted Russian organizations since 2025. Recently, they introduced a new backdoor for the first time. They use two versions of this backdoor: one connects through HiveMQ MQTT broker, and the other through the Element messenger. Both are named with “bird,” such as mqtt-bird-agent and matrix-bird-agent.
The group relies on Windows Remote Management (WinRM) to deliver the backdoors along with configuration files. They utilize open-source tools like Evil-WinRM. The backdoors can run interactively or be set as a Windows service. The options for launching include commands like –install or –service. Delivery involves sending configuration files over WinRM. Once installed, the backdoors can establish persistent access and communicate with C2 servers.
The HiveMQ version uses a public broker or their own server for command and telemetry exchange. The Element version connects to a custom server on meet.element[.]tw using the Matrix protocol. It communicates by sending status and metrics messages, and it retrieves commands from the server. Commands executed include PowerShell scripts run in hidden mode. Communication is maintained through HTTP GET and POST requests, or via MQTT or Matrix messages.
Impact, Security Implications, and Remediation Guidance
The development of a custom backdoor indicates Toy Ghouls’ move towards more sophisticated and covert operations. These backdoors give full control over infected devices, including command execution and system monitoring. The use of unconventional channels such as MQTT and Matrix makes detection harder and hampers traditional security defenses.
The security implications include increased risk of undetected intrusions, data theft, and potential deployment of ransomware or other malicious tools. The shift to custom tools suggests that existing signatures may not always identify these activities promptly.
Because specific remediation guidance is not provided in the report, organizations should consult their security vendors or relevant authorities. They are advised to review and strengthen network monitoring, especially around WinRM, MQTT, and Matrix communications. Additionally, securing remote management interfaces and conducting thorough incident response procedures can help detect and mitigate such threats.
Stay Ahead with the Latest Tech Trends
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Stay inspired by the vast knowledge available on Wikipedia.
ThreatIntel-V1
