/
← Voltar ao feed
high

Toy Ghouls deploys custom backdoors using HiveMQ MQTT and Element/Matrix as C2 against Russian organizations

1 fonte(s) · 1 atualização(ões) · publicado 04/09/2026 07:00 · coletado há 4 dias

Toy Ghouls (aka Bearlyfy, Laboo.boo, Feral Wolf), a financially motivated group targeting Russian organizations since 2025, was observed in early July 2026 using a custom backdoor for the first time. Kaspersky GERT identified two versions, mqtt-bird-agent 0.1.0 (C2 over the public HiveMQ MQTT broker) and matrix-bird-agent 0.1.0 (C2 over an attacker-run Element/Matrix server). The group previously relied on public GitHub tools and leaked Babuk and LockBit builders, then moved to its own ransomware GenieLocker. The backdoors give full control of an infected host and use legitimate services as C2 channels, which points to a push toward more sophisticated attacks and longer evasion.

Detalhes técnicos

  • Delivery: the backdoors and their configuration files are pushed over Windows Remote Management using the open-source tools Evil-WinRM and WinRM-fs.
  • Persistence: installed as a Windows service via the --install or install option. The service names are cplsupport ("Problem Reports Control Panel") and wtas ("Windows Telemetry Aggregator Service"). Binaries are cplsupport.exe and wtass.exe.
  • Configuration: config.toml is read from the launch directory, then from %PROGRAMDATA%\SynapseAgent\ (Element) or %PROGRAMDATA%\cplsupport\ (HiveMQ). On first run it is partially encrypted with ChaCha20-Poly1305, using a key derived from HKLM\Software\Microsoft\Cryptography\MachineGuid, so it is bound to that host. The backdoor stops if decryption fails. The HiveMQ config holds agent_privkey, channel_id and server_pubkey. The Element version deletes the file after the first run and stores it in HKLM\Software\synapse\Config\SealedConfig.
  • Recon: at startup both versions query http://ip-api.com/json for the public IP and country.
  • HiveMQ C2: broker.hivemq.com:8883/[cluster_id]/ with the paths status, metrics3, cmd/req and cmd/res. Commands run through hidden PowerShell.exe -NonInteractive -NoProfile -Command.
  • Element C2: attacker-controlled Matrix server meet.element[.]tw with a dedicated room. Custom message types are m.bird.status, m.bird.metrics and m.bird.cmd_response. Operator messages starting with cmd: execute through the Windows command line. config:set_interval (5–3600 s) sets the metrics interval, saved to HKLM\Software\SynapseAgent\metrics_interval. The operator account is panel-bot.
  • Detections: Kaspersky verdicts are HEUR:Backdoor.Win64.Suptoml.gen, HEUR:Trojan.Script.Zapchast.conf, Backdoor.Win64.Agent.smgdvy, Trojan.Script.Zapchast.abwm, Trojan.Win64.Agent.smgsfo and Trojan.Script.Zapchast.abwo.

Remediação

  • Hunt for the cplsupport and wtas services, the listed registry keys and the %PROGRAMDATA%\SynapseAgent and %PROGRAMDATA%\cplsupport directories.
  • Monitor and restrict WinRM, and watch for Evil-WinRM-style activity.
  • Review outbound traffic to broker.hivemq.com, ip-api.com and meet.element[.]tw from servers and endpoints where it is not expected.
  • Block or alert on the file hashes listed in the IOCs.

Linha do tempo

  1. securelist.com ↗ · pub. 04/09/2026 07:00 · coletado 19/10 17:57 primeiro registro

    Toy Ghouls deploys custom backdoors using HiveMQ MQTT and Element/Matrix as C2 against Russian organizations

    ler a análise desta fonte

    Toy Ghouls (aka Bearlyfy, Laboo.boo, Feral Wolf), a financially motivated group targeting Russian organizations since 2025, was observed in early July 2026 using a custom backdoor for the first time. Kaspersky GERT identified two versions, mqtt-bird-agent 0.1.0 (C2 over the public HiveMQ MQTT broker) and matrix-bird-agent 0.1.0 (C2 over an attacker-run Element/Matrix server). The group previously relied on public GitHub tools and leaked Babuk and LockBit builders, then moved to its own ransomware GenieLocker. The backdoors give full control of an infected host and use legitimate services as C2 channels, which points to a push toward more sophisticated attacks and longer evasion.

    Technical Details

    • Delivery: the backdoors and their configuration files are pushed over Windows Remote Management using the open-source tools Evil-WinRM and WinRM-fs.
    • Persistence: installed as a Windows service via the --install or install option. The service names are cplsupport ("Problem Reports Control Panel") and wtas ("Windows Telemetry Aggregator Service"). Binaries are cplsupport.exe and wtass.exe.
    • Configuration: config.toml is read from the launch directory, then from %PROGRAMDATA%\SynapseAgent\ (Element) or %PROGRAMDATA%\cplsupport\ (HiveMQ). On first run it is partially encrypted with ChaCha20-Poly1305, using a key derived from HKLM\Software\Microsoft\Cryptography\MachineGuid, so it is bound to that host. The backdoor stops if decryption fails. The HiveMQ config holds agent_privkey, channel_id and server_pubkey. The Element version deletes the file after the first run and stores it in HKLM\Software\synapse\Config\SealedConfig.
    • Recon: at startup both versions query http://ip-api.com/json for the public IP and country.
    • HiveMQ C2: broker.hivemq.com:8883/[cluster_id]/ with the paths status, metrics3, cmd/req and cmd/res. Commands run through hidden PowerShell.exe -NonInteractive -NoProfile -Command.
    • Element C2: attacker-controlled Matrix server meet.element[.]tw with a dedicated room. Custom message types are m.bird.status, m.bird.metrics and m.bird.cmd_response. Operator messages starting with cmd: execute through the Windows command line. config:set_interval (5–3600 s) sets the metrics interval, saved to HKLM\Software\SynapseAgent\metrics_interval. The operator account is panel-bot.
    • Detections: Kaspersky verdicts are HEUR:Backdoor.Win64.Suptoml.gen, HEUR:Trojan.Script.Zapchast.conf, Backdoor.Win64.Agent.smgdvy, Trojan.Script.Zapchast.abwm, Trojan.Win64.Agent.smgsfo and Trojan.Script.Zapchast.abwo.

    Remediation

    • Hunt for the cplsupport and wtas services, the listed registry keys and the %PROGRAMDATA%\SynapseAgent and %PROGRAMDATA%\cplsupport directories.
    • Monitor and restrict WinRM, and watch for Evil-WinRM-style activity.
    • Review outbound traffic to broker.hivemq.com, ip-api.com and meet.element[.]tw from servers and endpoints where it is not expected.
    • Block or alert on the file hashes listed in the IOCs.