Security researchers said the tools, identified as mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0, were first observed in early July. Toy Ghouls, also tracked as Bearlyfy, Laboo. boo and Feral Wolf, has targeted organisations in Russia and is assessed to be financially motivated.
The HiveMQ variant uses the public broker at broker. hivemq. com to exchange information and commands with infected machines. The Element version communicates through an attacker-controlled Element server operating on the Matrix protocol. Both approaches allow malicious traffic to blend with communications involving legitimate technologies, potentially complicating network-based detection.
Researchers said the campaign delivers the backdoors and their configuration files through Windows Remote Management, using open-source utilities including Evil-WinRM and WinRM-fs. Once executed, the malware can run interactively or install itself as a Windows service to maintain access after a restart.
The HiveMQ version registers as a service named cplsupport, presented as “Problem Reports Control Panel”, while the Element version uses the service name wtas and the display name “Windows Telemetry Aggregator Service”. Such names are designed to resemble ordinary Windows components and reduce the chance of drawing attention during a routine inspection.
Both versions also protect configuration data. The HiveMQ backdoor can partially encrypt its configuration using ChaCha20-Poly1305, deriving a key from the Windows MachineGuid value so the protected information is tied to the compromised computer. The Element version deletes its original configuration file after first execution and stores sealed data in the Windows registry.
On startup, the malware contacts ip-api. com to obtain the infected system’s public IP address and country information. The HiveMQ variant then reports status and system metrics, including processor load, memory usage, disk consumption and uptime, through attacker-selected channels on the broker.
Commands retrieved through HiveMQ are executed with PowerShell in hidden, non-interactive mode. The backdoor sends the resulting standard output, error output, exit code and execution time back through the same command infrastructure, giving operators a mechanism to control the host remotely and review the results.
The Matrix-based variant follows a similar pattern but communicates through an Element room. It sends status and performance data as Matrix messages and accepts commands prefixed with “cmd:”. Investigators examining local Element databases on compromised systems identified “panel-bot” as the account used to issue instructions.
That version can also receive a configuration message changing the interval at which system metrics are transmitted, with permitted values ranging from five to 3,600 seconds. Received commands are run through the Windows command-line interface, and the output is returned to the attackers as a separate Matrix message.
The findings show Toy Ghouls moving further away from an earlier reliance on publicly available offensive tools and leaked ransomware builders. The group had previously used leaked Babuk and LockBit builders before developing its own GenieLocker ransomware, according to the researchers tracking its activity.
The two backdoors extend that progression by giving the operators persistent remote-control capabilities rather than relying solely on ransomware deployment. Researchers said the use of unconventional command channels could help the group keep malicious communications active while making them less conspicuous amid legitimate network traffic.
HiveMQ is a legitimate MQTT technology provider, and Element is a legitimate communications platform built around the open Matrix protocol. The findings do not indicate that either service was itself compromised; rather, the attackers abused accessible or separately controlled infrastructure associated with those technologies for malicious communications.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
