Threat reportMalwareTL-2026-4506
Toy Ghouls (Bearlyfy) deploys new custom HiveMQ- and Element-based C2 backdoors (mqtt-bird-agent, matrix-bird-agent)
Toy Ghouls (Bearlyfy) deploys new custom HiveMQ- and (TL-2026-4506), also tracked as mqtt-bird-agent, is a high-severity malware campaign, first published 2026-10-27. It is attributed to Toy Ghouls with medium confidence, affects Microsoft Windows, maps to 12 MITRE ATT&CK techniques (T1021.006, T1027, T1036.004), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 12MITRE ATT&CK
- Actors
- 1Toy Ghouls
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-4506
- Threat ID
- TL-2026-4506
- Also known as
- mqtt-bird-agent, matrix-bird-agent, Angry Birds
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Toy Ghouls
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- unspecified
- Target regions
- russia
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in Toy Ghouls (Bearlyfy) deploys new custom HiveMQ- and
Malware and tooling: Babuk - S0638, GenieLocker, LockBit, Matrix, matrix-bird-agent 0.1.0, mqtt-bird-agent 0.1.0, Evil-WinRM, WinRM-fs
How Toy Ghouls (Bearlyfy) deploys new custom HiveMQ- and works
Kaspersky GERT reports that Toy Ghouls (Bearlyfy), a financially motivated group targeting Russian organizations since 2025, has moved from public tools and leaked ransomware builders to proprietary backdoors. mqtt-bird-agent 0.1.0 uses the public HiveMQ broker for C2 and matrix-bird-agent 0.1.0 uses an attacker-controlled Element (Matrix) server; both are delivered over WinRM and persist as Windows services.
Kaspersky GERT observed Toy Ghouls (aliases Bearlyfy, Laboo.boo, Feral Wolf) using a custom backdoor for the first time in early July 2026. Two variants exist, both named with 'bird': mqtt-bird-agent 0.1.0 (cplsupport.exe), which uses the public HiveMQ MQTT broker (broker.hivemq.com:8883) as its C2 channel, and matrix-bird-agent 0.1.0 (wtass.exe), which communicates through an attacker-controlled Element/Matrix server (meet.element.tw). Earlier Toy Ghouls activity relied on tools from public GitHub repositories and leaked Babuk and LockBit ransomware builders, later joined by the proprietary GenieLocker ransomware (Windows, Linux, ESXi).
Delivery: the operators place the backdoor binaries and configuration files on already-compromised hosts over Windows Remote Management (WinRM) using the open-source Evil-WinRM and WinRM-fs tools. Each binary supports --install / --uninstall (Windows service), --seal (encrypt sensitive config fields) and -c/--config options. The HiveMQ variant installs as service 'cplsupport' (display name 'Problem Reports Control Panel') with config at %PROGRAMDATA%\cplsupport\config.toml; the Element variant installs as service 'wtas' ('Windows Telemetry Aggregator Service') with config at %PROGRAMDATA%\SynapseAgent\config.toml, which is deleted after first run. Sensitive config values are sealed with ChaCha20-Poly1305 using a machine-bound key derived from HKLM\Software\Microsoft\Cryptography\MachineGuid; the Element variant stores its sealed config in HKLM\Software\synapse\Config\SealedConfig and its reporting interval in HKLM\Software\SynapseAgent\metrics_interval.
C2 behavior (HiveMQ): the agent queries http://ip-api.com/json to learn its public IP and country, publishes status ({online, hostname, timestamp, location}) to <cluster_id>/status, periodic CPU/memory/disk/load metrics to <cluster_id>/metrics3, polls <cluster_id>/cmd/req for {cmd_id, command, timeout_secs}, executes commands via PowerShell (-NonInteractive -NoProfile -Command) and returns stdout, stderr, exit_code and duration_ms to <cluster_id>/cmd/res. Encrypted config fields are agent_privkey, channel_id and server_pubkey. C2 behavior (Element): messages use custom types m.bird.status, m.bird.metrics and m.bird.cmd_response; commands come from the account 'panel-bot' with a 'cmd:' prefix for execution (via the Windows command line) and 'config:set_interval' (5-3600 s) to change the metrics interval; the access_token obtained after authentication is saved to a 'blob' field. Abusing a public broker and a messenger protocol lets C2 traffic blend with legitimate TLS traffic and complicates domain/IP blocking.
Kaspersky detection verdicts: HEUR:Backdoor.Win64.Suptoml.gen, HEUR:Trojan.Script.Zapchast.conf, Backdoor.Win64.Agent.smgdvy, Trojan.Script.Zapchast.abwm, Trojan.Win64.Agent.smgsfo, Trojan.Script.Zapchast.abwo. The source does not list CVEs, CVSS, victim sectors or MITRE techniques; severity is analyst-assigned. Prior public reporting (F6, via The Hacker News, 2026-03-27) describes Bearlyfy as having conducted 70+ attacks on Russian companies since January 2025, using exploitation of external services and vulnerable applications for access, and noting MeshAgent, a modified PolyVice ransomware (from May 2025) and GenieLocker (from March 2026).
MITRE ATT&CK techniques used in TL-2026-4506
Lateral Movement
T1021.006 Windows Remote Management
Defense Evasion
T1027 Obfuscated Files or Information; T1036.004 Masquerade Task or Service; T1070.004 File Deletion
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell
Discovery
T1082 System Information Discovery
Command and Control
T1102.002 Bidirectional Communication
defense-impairment
Persistence
Resource Development
Affected products and versions in Toy Ghouls (Bearlyfy) deploys new custom HiveMQ- and
- Microsoft — Windows
Vulnerable versions: Windows hosts reachable via WinRM after prior compromise
Remediation for Toy Ghouls (Bearlyfy) deploys new custom HiveMQ- and
Immediate actions
- Hunt for Windows services named cplsupport or wtas and binaries cplsupport.exe / wtass.exe
- Hunt for registry keys HKLM\Software\synapse\Config\SealedConfig and HKLM\Software\SynapseAgent\metrics_interval and for %PROGRAMDATA%\cplsupport\config.toml or %PROGRAMDATA%\SynapseAgent\config.toml
- Alert on non-broker endpoints connecting to broker.hivemq.com:8883 and on any traffic to meet.element.tw
- Investigate WinRM sessions (Evil-WinRM / WinRM-fs) delivering executables to hosts
Workarounds
- Block broker.hivemq.com and meet.element.tw at DNS/proxy where not business-required
- Block executables running from services with misleading names that lack a signed publisher
Longer-term hardening
- Restrict WinRM (TCP 5985/5986) to authorized management hosts and require strong authentication
- Egress-filter MQTT and Matrix traffic from servers; allow-list approved messaging services only
- Monitor new service installations and PowerShell child processes of unfamiliar services
- Maintain offline backups given the actor's ransomware (GenieLocker) capability
Timeline of Toy Ghouls (Bearlyfy) deploys new custom HiveMQ- and
- Bearlyfy/Toy Ghouls first surfaces, targeting Russian companies (F6 reporting; month-level date).
- Group begins using a modified PolyVice ransomware (per The Hacker News summary of F6 research; month-level date).
- F6 first documents the group using LockBit 3 (Black) and Babuk encryptors (month-level date).
- Proprietary GenieLocker ransomware deployed against Windows endpoints (month-level date).
- Public reporting that Bearlyfy has conducted 70+ attacks on Russian firms since January 2025.
- Kaspersky GERT observes first use of the custom bird backdoors (HiveMQ and Element variants) in early July 2026.
- Kaspersky GERT publishes 'Angry Birds: Toy Ghouls' new toys' detailing mqtt-bird-agent and matrix-bird-agent.
Sources cited for Toy Ghouls (Bearlyfy) deploys new custom HiveMQ- and
- Angry Birds: Toy Ghouls' new toys
- Bearlyfy Hits 70 Russian Firms with Custom GenieLocker Ransomware
- Toy Ghouls Targets Russian Organizations With New Windows Backdoors
- Toy Ghouls adopts HiveMQ, Element for Windows backdoors
- Hackers Use Popular Messaging Services to Control New Windows Backdoors
- Ransomware group Bearlyfy targeting Russia and Ukraine (The Record)
Detection coverage for TL-2026-4506
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4506 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.