TOY Ghouls, known as Bearlyfy, Labubu and related aliases, has expanded its toolkit with a bespoke backdoor that uses two different C2 channels: HiveMQ MQTT and the Matrix-based Element service.
The two builds—mqtt-bird-agent and matrix-bird-agent—each deliver full remote control over infected Windows hosts, with the initial intrusion vector described as Windows Remote Management (WinRM), using open-source tools such as Evil-WinRM and WinRM-fs to deploy the malware, which then installs as a Windows service for persistence. Kaspersky notes that this marks the group’s shift from public tools to customised tooling, reportedly active against Russian targets since 2025.
The backdoor stores configuration data in encrypted form using ChaCha20-Poly1305, with the key derived from the machine’s registry GUID, tying the config to a specific device. At run-time, the malware queries ip-api[.]com to determine the host’s public IP and country, then communicates with its designated C2 channel.
The HiveMQ variant posts system status and metrics to topics linked to a cluster ID and executes received commands via hidden PowerShell, while the Element variant connects to a controlled Matrix server (meet.element[.]tw), with an operator account linked to panel-bot and command execution via the Windows command line.
Kaspersky attributes the operation to Toy Ghouls with moderate confidence; no charges have been reported, so exploitation remains at attribution rather than judicial confirmation. organisations targeted reportedly include Russian industry and manufacturing, but victim counts have not been disclosed. Defences are advised to monitor for Evil-WinRM/WinRM-fs activity, outbound connections to public MQTT brokers, and unknown Matrix servers, and to limit WinRM usage where possible.