A financially motivated threat group tracked as Toy Ghouls has introduced two custom Windows backdoors that conceal command-and-control activity within commonly used messaging technologies. The tools use an MQTT broker and a Matrix-based server to receive instructions, report system status and maintain access after the attackers have already entered a victim network.

The development marks a notable change for a group that previously leaned on public utilities and leaked ransomware builders. Toy Ghouls—also known as Bearlyfy, Laboo.boo and Feral Wolf—has targeted Russian organizations since 2025 and has been linked to GenieLocker ransomware. Building dedicated implants suggests the operators want quieter, longer-lived access that can support surveillance, lateral movement or a later disruptive attack.

Two backdoors, two legitimate-looking channels

Researchers identified the implants in July 2026 and named them mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0. Both provide broad control over an infected Windows system, but they communicate differently.

The MQTT variant connects to the public broker.hivemq.com service. It announces whether the infected device is online, reports operational details such as CPU usage and available memory, and collects tasks from the broker. Commands are passed to a hidden PowerShell process for execution. MQTT is widely used for lightweight machine-to-machine communications, so traffic to a public broker may appear less suspicious than a connection to a newly registered command server.

The Matrix variant communicates with an attacker-controlled Element server. It posts device status into a designated room and accepts commands from an account named panel-bot, then runs them through the Windows command interpreter. Matrix and Element are legitimate communication technologies; their abuse does not imply that the underlying services are malicious. Their familiarity simply gives attackers another place to blend command traffic with routine internet use.

WinRM helps turn initial access into persistence

Toy Ghouls deploys the backdoors only after gaining entry to an organization. The attackers use Windows Remote Management, along with Evil-WinRM and WinRM-fs, to copy executables and configuration files to target machines and run commands remotely. WinRM is an important administrative feature in many enterprises, which makes context essential: a successful session from an unexpected workstation, account or network segment can be more revealing than the protocol alone.

Both implants can run interactively or install themselves as Windows services. Service installation lets them restart with the operating system and remain available after the original remote session ends. The MQTT edition has been associated with a service called cplsupport, presented as “Problem Reports Control Panel,” while the Matrix edition uses wtas, described as “Windows Telemetry Aggregator Service.” Those names are designed to look plausible during a casual review.

Configuration is stored initially in a config.toml file, with sensitive values protected using encryption tied to the compromised computer. In the Matrix variant, the file is removed after first use and sealed configuration data is placed in the Windows registry under Synapse-related keys. Moving settings away from an obvious disk artifact can complicate triage and persistence removal.

Detection and containment priorities

Defenders should treat the discovery as a reason to examine remote administration paths, not to block messaging technology indiscriminately. Useful actions include:

• Restrict WinRM to approved management hosts and require strongly protected privileged accounts.
• Investigate hidden PowerShell launched by unfamiliar services or following remote logons.
• Search endpoints for cplsupport.exe, wtass.exe, unexpected config.toml files and the suspicious service names.
• Review registry locations under HKLM\Software\synapse and HKLM\Software\SynapseAgent for unexplained configuration data.
• Analyze outbound connections to public MQTT brokers and unapproved Matrix homeservers in conjunction with endpoint behavior.

A warning beyond ransomware

Organizations familiar with Toy Ghouls may have focused hunting on ransomware artifacts and known public tools. The new implants broaden that picture. A quiet service that periodically reports system health can be a staging point for credential theft, reconnaissance or eventual encryption, even when no ransom note or noisy payload is present.

Incident responders should therefore investigate the original access route and every credential used over WinRM, isolate affected hosts, remove persistence and review adjacent systems for lateral movement. Blocking a single broker or server may interrupt one channel, but it will not resolve the compromise that allowed the backdoor to be installed.