A financially driven cybercriminal group known as Toy Ghouls has developed two tailored Windows backdoors that utilize popular messaging platforms for command and control. These tools allow for covert command execution, system information collection, and sustained control over compromised devices.
Shift in Strategy for Toy Ghouls
This campaign represents a strategic shift for Toy Ghouls, which previously relied on publicly available tools and leaked ransomware builders. The adoption of custom malware indicates an effort to remain undetected within victim networks for extended periods.
Security researchers at Securelist identified the new malware in early July 2026, linking it to Toy Ghouls, also known as Bearlyfy, Laboo.boo, and Feral Wolf. The group has targeted Russian organizations since 2025 and is associated with the GenieLocker ransomware.
Technical Details of the Backdoors
The newly identified backdoors, named mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0, are deployed post-intrusion, demonstrating how initial breaches can evolve into severe network compromises. According to a Kaspersky report to Cyber Security News (CSN), these tools offer complete control over infected Windows systems.
Toy Ghouls employs Windows Remote Management (WinRM) to install these backdoors and their configurations on compromised systems. They use Evil-WinRM and WinRM-fs to facilitate file transfers and remote command execution.
Maintaining Persistence and Mitigation Strategies
Both backdoor versions can operate interactively or as Windows services, ensuring persistence even after reboots. This feature heightens the threat, as attackers can regain access despite the termination of the original remote session.
The malware encrypts its configuration in a way specific to the infected system. The Element variant removes its configuration file after initial use, transferring data to the Windows registry to minimize detectable artifacts.
Security teams are advised to audit WinRM access, restrict it to approved systems, and scrutinize unusual remote PowerShell activity. Monitoring for unexpected services such as cplsupport or wtas and suspicious configuration files in ProgramData folders is crucial.
Implications for Cybersecurity
The case underlines the necessity of viewing remote-management credentials as high-value assets, warranting robust authentication measures. Recent attacks highlight the dangers posed by the combination of social engineering and trusted Windows tools.
Despite the misuse of MQTT and Element protocols by Toy Ghouls, these services themselves are not inherently malicious. The situation exemplifies how threat actors exploit legitimate technologies to obfuscate command traffic and maintain control over compromised systems.
Security operations centers should remain vigilant and update detection capabilities to identify quiet backdoor activities, which often precede more overt ransomware operations.
