TOY Ghouls has expanded its toolkit with two new backdoors, each nicknamed with “bird” in the name, and employing unconventional C2 channels: a HiveMQ MQTT broker and the Matrix-based Element messenger. Discovered in July 2026, the group’s first backdoor is the mqtt-bird-agent (HiveMQ, version 0.1.0), while the second is the matrix-bird-agent (Element, version 0.1.0).
The operators deliver these backdoors and their configuration files over Windows Remote Management (WinRM) using open-source tools such as Evil-WinRM and WinRM-fs. On installation, the backdoors can run interactively via a command line or persist as a Windows service (install); the HiveMQ variant exposes a --install option, while the Element variant uses a service approach via wtass[.]exe for the Matrix version.
In both versions, the backdoors support running PowerShell commands in hidden mode and expose options for sealing configuration data, binding it to the host machine (HiveMQ) or storing it in the Windows Registry (Element).
The HiveMQ version communicates with broker.hivemq[.]com (the free tier used as C2) to send status and telemetry, retrieve commands, and post results, with specific endpoints for status, metrics, cmd/req, and cmd/res. The Element version uses the Matrix-based server meet.element[.]tw to exchange m[.]bird.* messages (status, metrics, and cmd_response), with commands executed via the Windows command line.
The HiveMQ variant stores its configuration in an encrypted blob in config[.]toml, including agent_privkey, channel_id, and server_pubkey; the Element variant retains configuration in the HKLM\\Software\\SynapseAgent\\Config\\SealedConfig registry key and retrieves credentials from there.
Indicators of compromise include file names such as cplsupport[.]exe and wtass[.]exe, the presence of config[.]toml, and registry keys HKLM\\Software\\synapse\\Config\\SealedConfig and HKLM\\Software\\SynapseAgent\\metrics_interval. The campaigns also perform an initial public IP/country check via ip-api[.]com/json. The shift to bespoke C2 channels suggests Toy Ghouls aims to evade traditional detections and extend operational longevity.