New Windows Backdoors Controlled via Popular Messaging Services
Key Takeaways The financially motivated threat group Toy Ghouls has shifted its tactics, now deploying two custom Windows backdoors. These new backdoors, named mqtt-bird-agent 0.1.0 and...
Key Takeaways
- The financially motivated threat group Toy Ghouls has shifted its tactics, now deploying two custom Windows backdoors.
- These new backdoors, named mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0, leverage popular messaging and broker services (HiveMQ and Element) for discreet command and control.
- The malware allows attackers to execute commands, gather system information, and maintain persistent access to compromised Windows systems.
- This evolution from public tools to custom malware signals an intent for longer dwell times and increased evasion of security detection.
- Defenders should prioritize strong authentication for remote management, monitor for unusual WinRM activity, and scrutinize network traffic for communications with the identified messaging infrastructure.
A financially motivated cybercrime collective, identified as Toy Ghouls, has adopted a more sophisticated approach to its operations. The group is now deploying two custom-built Windows backdoors that exploit common messaging and broker services for stealthy command and control (C2) communications.
Table Of Content
These new malicious tools provide the attackers with an inconspicuous channel to issue commands, extract sensitive system data, and maintain a persistent foothold on compromised machines. The shift to bespoke malware represents a significant tactical pivot for Toy Ghouls, which historically relied on readily available tools and leaked ransomware builders.
This strategic change suggests the group aims to extend its presence within victim networks and complicate detection efforts by security teams. Researchers at Securelist first uncovered these backdoors in early July 2026. They attributed the malware to Toy Ghouls, an entity also known by the aliases Bearlyfy, Laboo.boo, and Feral Wolf. This group has been actively targeting Russian organizations since 2025 and is known for deploying its proprietary GenieLocker ransomware.
The new backdoors, designated mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0, are typically deployed post-initial compromise. This highlights how even minor initial security breaches can escalate into significant and enduring threats. According to a report from Kaspersky shared with Cyber Security News (CSN), these tools grant threat actors complete control over an infected Windows device.
Hackers Exploit Popular Messaging Services for C2
Toy Ghouls leverages Windows Remote Management (WinRM) to install the backdoors and their associated configuration files onto already compromised systems. The attackers utilize tools such as Evil-WinRM and WinRM-fs, which facilitate file transfers and remote command execution across Windows environments.
WinRM is a legitimate administrative feature widely used for network management, making its abuse particularly challenging to detect without stringent monitoring protocols. Organizations have previously encountered similar risks from the exploitation of Windows Remote Management, where attackers leverage valid access and remote sessions to deepen their penetration into a network. The HiveMQ variant of the backdoor uses the public broker.hivemq.com MQTT service as its primary command-and-control channel. It reports the device’s online status, transmits system information like processor usage and available memory, and fetches commands that are then executed via a hidden PowerShell process.
The use of a public broker service allows the attackers to camouflage their malicious traffic within legitimate internet activity. This method mirrors an earlier MQTT command channel employed by WailingCrab, underscoring how widely used cloud and messaging infrastructure can complicate forensic investigations.
The second variant of the backdoor utilizes an attacker-controlled Element server, which operates on the Matrix protocol. This version transmits device status updates to a designated chat room, receives commands from an account named “panel-bot,” and executes these instructions through the Windows command line interface.
Both backdoor variants can operate either interactively or install themselves as Windows services. This service installation mechanism provides persistence, allowing them to automatically restart after a system reboot. This method of persistence significantly elevates the danger of the infection, as attackers can regain access even if their initial remote session is terminated.
Persistence and Defensive Response
The malware stores its configuration settings in a file named config.toml. Sensitive fields within this file are encrypted using a key unique to the infected computer. In the case of the Element variant, this configuration file is deleted after its initial use, with the information subsequently migrated to the Windows registry. This tactic reduces the number of readily identifiable artifacts left on the disk, making detection more difficult for security tools.
The discovery of these new backdoors underscores the importance of proactive defense strategies. It also highlights the necessity of monitoring for subtle backdoor activities, rather than focusing solely on known ransomware signatures. A recent Windows backdoor investigation similarly revealed how attackers can minimize detectable network signals while awaiting further instructions.
It is crucial to emphasize that Toy Ghouls’ use of MQTT and Element does not imply that these services are inherently malicious. Instead, this case exemplifies how threat actors can co-opt legitimate and widely used technologies to conceal their command traffic, exfiltrate system data, and maintain prolonged control over compromised Windows systems.
Indicators of Compromise (IoCs)
| Type | Indicator | Description |
|---|---|---|
| File name | cplsupport.exe |
HiveMQ-based backdoor executable |
| MD5 hash | BFADBEEE63A4F0BF19EC9DEB8FA58F58
Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.
|
No Comment! Be the first one.