Hackers Hide Windows Backdoor Inside HiveMQ and Element Chat

Toy Ghouls' New Windows Backdoors Turn HiveMQ and Element Into Stealth C2 Channels

Quick Answer: The Toy Ghouls group is running two new Windows backdoors that hide command-and-control traffic inside legitimate HiveMQ MQTT and Element/Matrix messaging services. Defenders should watch WinRM activity, unfamiliar Windows services, and outbound traffic to those platforms.

Last verified: September 8, 2026

A SOC analyst scrolling through a Windows host's outbound connections in most environments would skip right past traffic to broker.hivemq.com. It's a legitimate IoT messaging broker, the kind of infrastructure that shows up in smart building systems, telemetry pipelines, and dev environments every day. That's exactly the assumption a financially motivated group called Toy Ghouls is now betting on — and according to Kaspersky's GERT researchers, it's paying off.

For the first time since it started targeting Russian organizations in 2025, Toy Ghouls has swapped its usual playbook of public GitHub tools and leaked ransomware builders for two purpose-built Windows backdoors. One talks to its operators over an MQTT broker. The other rides inside an Element/Matrix chat room. Neither service is compromised — they're being used exactly as designed, just by the wrong people.

Table of Contents

• What Happened: Toy Ghouls' Shift to Custom Malware
• Inside the Backdoors: mqtt-bird-agent and matrix-bird-agent
• How the Malware Gets In: WinRM Abuse
• Persistence: Disguised as Everyday Windows Services
• Machine-Bound Encryption: ChaCha20-Poly1305
• Indicators of Compromise
• Detection and Prevention Techniques
• Expert Tips for SOC Teams
• FAQ
• Conclusion

What Happened: Toy Ghouls' Shift to Custom Malware

Toy Ghouls — also tracked under the aliases Bearlyfy, Laboo.boo, and Feral Wolf — is a financially motivated threat group that has been active against Russian organizations since 2025. Kaspersky's Global Emergency Response Team (GERT) reports that the group initially relied almost entirely on tools pulled from public repositories, plus leaked Babuk and LockBit ransomware builders, before rolling out its own ransomware family, GenieLocker.

In early July 2026, researchers observed something new: a custom backdoor, deployed in two separate builds, appearing on already-compromised Windows hosts. According to Securelist's writeup, this marks a deliberate move toward more sophisticated, harder-to-detect tooling rather than a one-off experiment.

Inside the Backdoors: mqtt-bird-agent and matrix-bird-agent

Kaspersky identified the two builds as mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0. Despite the different transport mechanisms, they share a common design lineage — both are "bird" tools built to phone home, report status, and execute operator commands on a compromised Windows machine.

• mqtt-bird-agent connects to the public HiveMQ MQTT broker at broker.hivemq.com. It reports whether the device is online, sends system metrics such as CPU usage and free memory, and pulls down instructions that get executed through a hidden PowerShell process.
• matrix-bird-agent connects to an attacker-controlled Element server running on the Matrix protocol. It posts device status to a designated chat room and receives commands from an account named panel-bot, executing them through the Windows command line.

Both variants give the operator full functional control over the infected machine, and both can run interactively in memory or install themselves as a persistent Windows service — a detail that matters a lot for incident response, covered below.

This isn't a brand-new idea — researchers note the approach echoes an earlier MQTT-based command channel used by the WailingCrab malware family. What's notable here is how deliberately Toy Ghouls picked infrastructure that blends into ordinary enterprise and IoT network noise.

How the Malware Gets In: WinRM Abuse

These backdoors aren't the initial foothold — they're a second-stage tool dropped after attackers already have a way into the network. Kaspersky's analysis shows Toy Ghouls pushing the backdoor binaries and their configuration files onto compromised systems using Windows Remote Management (WinRM), via the open-source utilities Evil-WinRM and WinRM-fs.

This is a familiar problem for defenders: WinRM is a legitimate, widely used administration protocol, which means malicious use can easily hide in the noise of normal sysadmin activity. Security teams have seen this pattern before in other WinRM-abuse campaigns, where valid credentials and remote sessions become the bridge to deeper network access.

Persistence: Disguised as Everyday Windows Services

Once deployed, both backdoor variants can install themselves as Windows services so they survive a reboot — turning a single remote session into a standing foothold. The naming choices are deliberately mundane:

• The HiveMQ variant registers as cplsupport, displayed as "Problem Reports Control Panel."
• The Element variant registers as wtas, displayed as "Windows Telemetry Aggregator Service."

Neither name is a real default Windows service, but both are close enough to plausible system components that they're easy to overlook during a quick services.msc scan.

Machine-Bound Encryption: ChaCha20-Poly1305

Toy Ghouls also took steps to make forensic analysis harder. Sensitive fields in the backdoor's config.toml file are encrypted with ChaCha20-Poly1305, with the decryption key derived from the infected system's MachineGuid registry value. In practice, this ties the configuration to that specific machine — copying the file to an analyst's sandbox won't get you a working decryption without also capturing that registry value.

The Element variant goes a step further: after first use, the config.toml file is deleted from disk entirely, and the settings are moved into the Windows registry — reducing the number of obvious artifacts an incident responder would find sitting in plain sight. Both variants query the legitimate service ip-api.com at startup to identify the victim's public IP address and country, likely for targeting or reporting purposes.

Indicators of Compromise

Confirmed indicators from Kaspersky's Securelist report are summarized below. As always, treat domains as defanged and re-fang only inside a controlled threat-intel platform such as MISP, VirusTotal, or your SIEM.

Type	Indicator	Description
File name	cplsupport.exe	HiveMQ-based backdoor executable
MD5 hash	BFADBEEE63A4F0BF19EC9DEB8FA58F58	Hash associated with cplsupport.exe
File name	wtass.exe	Element-based backdoor executable
MD5 hash	7916C33688385525078BEE504C90F359	Hash associated with wtass.exe
File name	config.toml	Backdoor configuration file
Registry key	HKLM\Software\synapse\Config\SealedConfig	Stores sealed Element backdoor configuration
Registry key	HKLM\Software\SynapseAgent\metrics_interval	Stores Element variant metrics reporting interval
Service name	cplsupport (Problem Reports Control Panel)	Service used by the HiveMQ variant
Service name	wtas (Windows Telemetry Aggregator Service)	Service used by the Element variant
Domain	broker.hivemq[.]com	Legitimate MQTT broker abused for C2
Domain	ip-api[.]com	Legitimate service queried for victim IP/geolocation
Domain	meet.element[.]tw	Attacker-controlled Element server used for C2

Detection and Prevention Techniques

None of these indicators are useful sitting in a spreadsheet — they need to turn into monitoring logic. Here's where to focus:

• Audit WinRM access. Restrict WinRM to a short, approved list of management systems, and alert on WinRM sessions originating from unusual source hosts or accounts.
• Hunt for hidden PowerShell activity. The HiveMQ variant runs commands through a hidden PowerShell process — enable PowerShell Script Block Logging (Event ID 4104) and look for PowerShell processes with no visible window spawned by unexpected parent processes.
• Watch service creation events. Monitor Windows Event ID 7045 (a new service was installed) for service names that don't match your organization's known baseline, especially generic-sounding ones like "Problem Reports Control Panel" or "Windows Telemetry Aggregator Service."
• Flag outbound traffic to messaging/broker infrastructure from servers. A file server or domain controller reaching out to an MQTT broker or a Matrix homeserver is a strong anomaly signal in most enterprise environments — that kind of traffic normally belongs to IoT devices or dev workstations, not core infrastructure.
• Check ProgramData for unexpected config files. Kaspersky's analysis notes configuration files dropped in ProgramData folders as part of this campaign; a quick sweep for unfamiliar .toml files is low-effort and worthwhile.
• Treat privileged remote-management credentials as high-value assets. Enforce strong, phishing-resistant authentication for any account with WinRM or remote administration rights.

A simple example of a defensive PowerShell check an incident responder might run during triage — to list recently created, non-standard services on a host — looks like this:

Get-CimInstance -ClassName Win32_Service | Where-Object { $_.PathName -notlike "*Windows*" } | Select-Object Name, DisplayName, PathName, StartMode

This pulls a list of services whose executable path doesn't sit under a typical Windows system directory, which is a fast way to surface anomalies like cplsupport or wtas for closer review. It's a hunting aid, not a silver bullet — always correlate results against your known-good service baseline.

Expert Tips for SOC Teams

• Don't rely solely on domain reputation for MQTT or Matrix-related C2 detection — broker.hivemq.com and legitimate Element homeservers will never show up on a malicious-domain blocklist, because they aren't malicious.
• Baseline "normal" outbound traffic per host role. A workstation talking to Slack or Teams is expected; a backend server doing the same over MQTT is not.
• Build detection around behavior (WinRM-delivered payloads, disguised service installs, hidden PowerShell) rather than only IOCs, since domains and hashes in a campaign like this can change build to build.
• Cross-reference this activity with any known Toy Ghouls initial-access patterns your threat intel team tracks, since the backdoors are a second-stage tool, not the point of entry.

Related Cybersecurity Topics You Should Explore

• Plex Emailed Users Over Hidden Security Flaws — Update Now
  
• TP-Link Archer AX55 Flaws Let Hackers Steal Admin Access
  
• Trezor ShipMonk Breach Widens to 80,000+ US Customers
  
• Microsoft Teams QR Code Protection: What Changes in October 2026
  
• Dahua Camera Backdoor Survives Password Resets and Factory Resets
  
• Is Your Driver's License for Sale? 153 Million Records Leaked, FBI Investigates
  
• QR Code Phishing Just Hit Record Levels: What SOCs Must Know Now
  
• Microsoft Teams Won't Load? Inside the TM1466820 Windows Bug
  
• Why Ad Networks Get Your Blogger Blog Locked (Fix It Fast)
  
• The touch Command Trick Attackers Use to Fake File Timestamps

FAQ

Is HiveMQ or Element compromised?
No. Researchers are clear that both are legitimate, unaffected platforms. Toy Ghouls is abusing publicly available infrastructure (HiveMQ) and self-hosted Matrix/Element servers to hide C2 traffic, not exploiting a vulnerability in either service.

Who is Toy Ghouls?
A financially motivated threat group, also tracked as Bearlyfy, Laboo.boo, and Feral Wolf, that has targeted Russian organizations since 2025 and previously developed the GenieLocker ransomware.

What is mqtt-bird-agent?
One of two new Toy Ghouls Windows backdoors. It uses the public HiveMQ MQTT broker as its command-and-control channel to receive instructions and report device telemetry.

What is matrix-bird-agent?
The second backdoor variant, which communicates through an attacker-controlled Element server built on the Matrix protocol, receiving commands from an account called panel-bot.

How does the malware get onto a system in the first place?
Per Kaspersky's findings, it's delivered to already-compromised hosts via Windows Remote Management (WinRM), using tools like Evil-WinRM and WinRM-fs — meaning initial access happens through some other means first.

Can this backdoor survive a reboot?
Yes. Both variants can install themselves as a Windows service (cplsupport or wtas), allowing them to persist and restart automatically.

What should organizations do right now?
Audit WinRM access and restrict it to approved systems, hunt for the specific service names and file hashes listed in the IOC table, enable PowerShell logging, and monitor outbound connections to MQTT and Matrix infrastructure from servers that shouldn't be using them.

Conclusion

The Toy Ghouls case is a reminder that the safest-looking traffic on your network — messaging protocols, IoT brokers, chat platforms — can double as a covert command channel in the right attacker's hands. Blocklists built around "known bad" domains won't catch this kind of abuse, because nothing about HiveMQ or Element is inherently malicious. What will catch it is disciplined monitoring of WinRM usage, service creation events, and outbound traffic that doesn't match a host's normal role.

If your SOC hasn't reviewed WinRM access controls or audited for unfamiliar Windows services recently, this campaign is a good reason to move it up the list. Have thoughts on this technique, or seeing similar traffic in your own environment? Drop a comment or share this with your security team.

Analysis based on public threat intelligence review (Kaspersky Securelist/GERT research) and standard SOC detection practices.