Hackers abuse messaging services to control backdoors on Windows
On September 4, 2026, Kaspersky disclosed two custom Windows backdoors used by the Toy Ghouls threat group: mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0. The malware uses HiveMQ and the Element messaging platform as command-and-control channels, allowing attackers to issue commands and maintain access to already-compromised Windows systems. No specific CVE has been linked to the activity.
Legitimate online services do not always generate legitimate traffic. In a campaign analyzed by Kaspersky, the financially motivated threat group Toy Ghouls abused HiveMQ and Elemen - both legitimate platforms to exchange commands with custom Windows backdoors.
The risk is not that HiveMQ or Element themselves are malicious. The more important issue for enterprises is that attackers can combine legitimate services with WinRM, PowerShell, and Windows services, making malicious activity more difficult to distinguish from normal administrative traffic.
What happened in the Toy Ghouls campaign?
Kaspersky GERT reported that Toy Ghouls began using custom-developed backdoors in early July 2026. The development marks a shift for a group that had previously relied heavily on publicly available tools and leaked ransomware builders associated with Babuk and LockBit.
Toy Ghouls is also tracked under names including Bearlyfy, Laboo.boo, and Feral Wolf. Kaspersky describes the group as financially motivated and says it has targeted organizations in Russia since 2025.
The two newly observed backdoors are:
Backdoor | Communication method |
mqtt-bird-agent 0.1.0 | Uses a HiveMQ MQTT broker |
matrix-bird-agent 0.1.0 | Uses Element based on the Matrix protocol |
Both tools allow attackers to receive information from infected devices, send remote commands, and maintain control after compromising a Windows system.
The development also follows Toy Ghouls’ previous use of GenieLocker, a custom ransomware family designed for Windows, Linux, and VMware ESXi environments.
How do the attackers use HiveMQ and Element to control the backdoors?
Instead of relying only on a dedicated command-and-control server with an obviously suspicious domain, Toy Ghouls uses widely available services as intermediaries for command traffic.
The mqtt-bird-agent variant communicates through broker.hivemq.com, a legitimate MQTT broker.
After execution, the backdoor can collect and transmit system information, including CPU usage, memory consumption, disk capacity, and device uptime. It then checks for instructions from the attacker and can execute them through hidden PowerShell processes.
It is important to make one distinction clear: there is no evidence that HiveMQ, Element, or Matrix were compromised. The attackers are abusing legitimate infrastructure as communication channels.
For enterprises, the broader lesson is that blocking known malicious domains is not enough. Traffic analysis must also consider which process created the connection, which device initiated it, and whether the activity matches expected business behavior.
How are the backdoors deployed on Windows systems?
Kaspersky observed Toy Ghouls using Windows Remote Management, or WinRM, to transfer the backdoors and related configuration files to systems that had already been compromised.
The group reportedly used the open-source tools Evil-WinRM and WinRM-fs during this stage.
This distinction matters because the available reporting does not explain how Toy Ghouls initially gained access to each victim environment. There is currently no basis to claim that a particular CVE, WinRM vulnerability, or exploit was responsible for initial access.
Once deployed, the backdoors can run through an interactive command-line session or install themselves as Windows services. This persistence mechanism allows the malware to start again after a reboot and maintain access for a longer period.
For the Element-based variant, Kaspersky also found that the configuration file may be deleted after the first execution. Configuration data can then be stored in the Windows Registry, reducing the number of obvious files left on disk.
What indicators should enterprises monitor?
Security teams should monitor endpoints, Windows Registry activity, Windows services, PowerShell execution, and outbound network traffic together. Searching for a single domain or malware hash is unlikely to provide sufficient coverage.
Some Indicators of Compromise published by Kaspersky include:
Type | Indicator |
File | cplsupport.exe |
MD5 | BFADBEEE63A4F0BF19EC9DEB8FA58F58 |
File | wtass.exe |
MD5 | 7916C33688385525078BEE504C90F359 |
Configuration file | config.toml |
Registry | HKLM\Software\synapse\Config\SealedConfig |
Registry | HKLM\Software\SynapseAgent\metrics_interval |
Windows service | cplsupport |
Windows service | wtas |
Server | meet.element[.]tw |
Legitimate service abused | |
Legitimate service abused |
Enterprises should not automatically classify every connection to broker.hivemq.com or ip-api.com as malicious. Both are legitimate services.
👉 Organizations can also review enterprise vulnerability assessment practices to identify exposed administration services, weak configurations, and unmanaged assets that may increase post-compromise risk.
What should enterprises do immediately?
The first priority is to identify where WinRM is enabled, which accounts are permitted to use it, and which management systems are authorized to initiate remote sessions.
Initial response checklist:
Inventory servers and endpoints with WinRM enabled.
Confirm which systems genuinely require WinRM for administration.
Restrict WinRM access to approved management hosts.
Review unusual WinRM sessions and unexpected administrative accounts.
Search for cplsupport.exe, wtass.exe, and config.toml.
Check for Windows services named cplsupport and wtas.
Hunt for the Registry keys disclosed by Kaspersky.
Investigate hidden or unusual PowerShell activity.
Correlate connections to HiveMQ, Element, and ip-api.com with source processes.
If compromise is confirmed, isolate affected devices and activate the Incident Response process instead of only deleting files.
What does IPSIP Vietnam’s expert perspective suggest?
A remote backdoor can allow attackers to execute commands, collect system information, and maintain a foothold inside the environment. Depending on the privileges obtained, that access can enable further reconnaissance, lateral movement, or other malicious actions.
Toy Ghouls’ new backdoors show how attackers can use legitimate technology to make command-and-control traffic less obvious. That creates a challenge for security programs that depend heavily on static IP, domain, or malware signature detection.
For Vietnamese enterprises, the priority should not be blanket blocking of HiveMQ or Element. More effective controls include restricting remote administration, monitoring PowerShell and Windows service activity, and correlating outbound network traffic with endpoint behavior. Early detection of suspicious activity chains is more valuable than focusing on a single indicator in isolation.
References
Kaspersky Securelist - Angry Birds: Toy Ghouls’ new toys
Cyber Security News - Hackers Use Popular Messaging Services to Control New Windows Backdoors
Kaspersky Securelist - Toy Ghouls’ new toy: the GenieLocker ransomware
Comments