Threat actor
Toy Ghouls
Tracked by CyberSIXT since Jul 30, 2026 · last activity Sep 4, 2026
Coverage timeline
-
Toy Ghouls Deploys Custom Backdoor via WinRM in Russian Attackssecurityonline.info · Sep 4, 2026
-
Toy Ghouls Hides Backdoors in HiveMQ and Element Messaging Systemssecurelist.com · Sep 4, 2026
-
GenieLocker ransomware hits Russian firms, linked to Toy Ghouls.securityonline.info · Aug 5, 2026
-
Toy Ghouls' GenieLocker ransomware hits Russian firms via VPNsecurelist.com · Jul 30, 2026