Toy Ghouls Deploys Custom Backdoor via Unconventional Channels

In early July 2026, the group known as Toy Ghouls deployed a custom backdoor for the first time, using two builds named mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0 to manage compromised systems and relay commands through unconventional channels.

What the tools are and how they evolved

The activity profile described in the report shows an evolution from reuse of public, leaked tools toward bespoke malware. Toy Ghouls previously relied on publicly available GitHub tools and leaked Babuk and LockBit builders, later developing their own GenieLocker ransomware. The newly observed backdoors — one built to use the HiveMQ MQTT broker, the other built to use the Element (Matrix) protocol — represent the group’s first known custom backdoor effort.

Delivery, installation, and persistence

The backdoors are delivered to target systems over Windows Remote Management (WinRM). The attackers use open-source utilities such as Evil-WinRM and WinRM-fs to move executables and configuration files. Each backdoor can run interactively or install as a Windows service: the HiveMQ build accepts a --install option (and exposes a --service internal argument), while the Element build exposes install, uninstall, and service subcommands. Default configuration lookup falls back to the local directory and to program-data locations (%PROGRAMDATA%\\SynapseAgent\\config.toml for Element; %PROGRAMDATA%\\cplsupport\\config.toml for HiveMQ). If configuration is not provided, the full path may be supplied with -c/--config.

Configuration handling and machine binding

Both builds accept either plaintext or partially encrypted configuration files. If the backdoor receives plaintext configuration, it will use a seal() routine to partially encrypt sensitive fields in-place with ChaCha20-Poly1305 and a key derived from the machine’s HKLM\\Software\\Microsoft\\Cryptography\\MachineGuid value. That operation binds the configuration to that specific host; if the backdoor cannot decrypt its configuration on subsequent runs, it will stop. The HiveMQ version stores encrypted fields such as agent_privkey, channel_id, and server_pubkey inside the config blob. The Element build deletes its config file after first run and writes the configuration into HKLM\\Software\\synapse\\Config\\SealedConfig in the registry.

Communications: broker.hivemq.com and meet.element[.]tw

Both backdoors first query http://ip-api.com/json at startup to learn the host’s public IP and country. The HiveMQ-based build uses the public HiveMQ broker (broker.hivemq.com) and the attackers’ own cluster on that infrastructure to collect telemetry and issue commands. Status is posted to broker.hivemq.com:8883/[cluster_id]/status and metrics to broker.hivemq.com:8883/[cluster_id]/metrics3 in JSON formats described in the report. Commands are polled from broker.hivemq.com:8883/[cluster_id]/cmd/req and responses sent to broker.hivemq.com:8883/[cluster_id]/cmd/res; commands are executed through PowerShell.exe in hidden mode using the -NonInteractive -NoProfile -Command parameters.

The Element-based build connects to an attacker-controlled Element server at meet.element[.]tw and uses a Matrix room to receive and return messages. Once connected the backdoor sends m.bird.status and m.bird.metrics messages; metrics field names differ slightly (the Element version multiplies some load and CPU fields by 100 in the metric labels). The Element build supports config:set_interval messages (values 5–3600 seconds, saved to HKLM\\Software\\SynapseAgent\\metrics_interval) and command messages that begin with cmd:. Commands are executed via the Windows command-line interface. Forensic extraction of Element SQLite databases revealed the account name used by the operators to send commands: panel-bot.

Indicators of compromise and artifacts

• Filenames and MD5 hashes: cplsupport.exe (BFADBEEE63A4F0BF19EC9DEB8FA58F58), wtass.exe (7916C33688385525078BEE504C90F359)
• Service names: cplsupport (Problem Reports Control Panel) and wtas (Windows Telemetry Aggregator Service)
• Registry keys: HKLM\\Software\\synapse\\Config\\SealedConfig and HKLM\\Software\\SynapseAgent\\metrics_interval
• Domains: meet.element[.]tw, broker.hivemq.com, ip-api.com
• Kaspersky security solution verdicts listed in the report include: HEUR:Backdoor.Win64.Suptoml.gen, HEUR:Trojan.Script.Zapchast.conf, Backdoor.Win64.Agent.smgdvy, Trojan.Script.Zapchast.abwm, Trojan.Win64.Agent.smgsfo, Trojan.Script.Zapchast.abwo

What this means for technologists, affected enterprises, and incident responders

• Technologists and security teams: monitor WinRM activity and file drops that match cplsupport.exe or wtass.exe; validate service names and the presence of the registry keys noted above; watch for outbound queries to ip-api.com and connections to broker.hivemq.com or meet.element[.]tw.
• Affected enterprises and procurement leaders: the group’s move from reused open-source and leaked builders toward custom ransomware (GenieLocker) and bespoke backdoors indicates investment in persistence and stealth; consider prioritizing controls that limit lateral WinRM use and enforce strong service-account hygiene.
• Incident responders and forensic teams: extract Element/Matrix SQLite artifacts to identify operator accounts (reporting found panel-bot) and recover room identifiers; examine %PROGRAMDATA% locations and the MachineGuid-bound sealed config blobs when assessing a host.

The tracked shift — from open-source tooling and leaked builders to a suite combining GenieLocker ransomware with mqtt-bird and matrix-bird backdoors — points to an operator intent on sustained access and covert command and control. Defenders should pair detection for the listed artifacts with scrutiny of WinRM activity and the distinctive C2 channels documented here.

https://securelist.com/toy-ghouls-new-hivemq-and-element-backdoors/121270/