# Toy Ghouls (Bearlyfy) deploys new custom HiveMQ- and Element-based C2 backdoors (mqtt-bird-agent, matrix-bird-agent)

> Kaspersky GERT reports that Toy Ghouls (Bearlyfy), a financially motivated group targeting Russian organizations since 2025, has moved from public tools and leaked ransomware builders to proprietary backdoors. mqtt-bird-agent 0.1.0 uses the public HiveMQ broker for C2 and matrix-bird-agent 0.1.0 uses an attacker-controlled Element (Matrix) server; both are delivered over WinRM and persist as Windows services.

- **Published:** 2026-10-27T02:50:26Z
- **Last reviewed:** 2026-10-27T02:50:26Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4506
- **ID:** TL-2026-4506
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Toy Ghouls
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Kaspersky GERT observed Toy Ghouls (aliases Bearlyfy, Laboo.boo, Feral Wolf) using a custom backdoor for the first time in early July 2026. Two variants exist, both named with 'bird': mqtt-bird-agent 0.1.0 (cplsupport.exe), which uses the public HiveMQ MQTT broker (broker.hivemq.com:8883) as its C2 channel, and matrix-bird-agent 0.1.0 (wtass.exe), which communicates through an attacker-controlled Element/Matrix server (meet.element.tw). Earlier Toy Ghouls activity relied on tools from public GitHub repositories and leaked Babuk and LockBit ransomware builders, later joined by the proprietary GenieLocker ransomware (Windows, Linux, ESXi).

Delivery: the operators place the backdoor binaries and configuration files on already-compromised hosts over Windows Remote Management (WinRM) using the open-source Evil-WinRM and WinRM-fs tools. Each binary supports --install / --uninstall (Windows service), --seal (encrypt sensitive config fields) and -c/--config options. The HiveMQ variant installs as service 'cplsupport' (display name 'Problem Reports Control Panel') with config at %PROGRAMDATA%\cplsupport\config.toml; the Element variant installs as service 'wtas' ('Windows Telemetry Aggregator Service') with config at %PROGRAMDATA%\SynapseAgent\config.toml, which is deleted after first run. Sensitive config values are sealed with ChaCha20-Poly1305 using a machine-bound key derived from HKLM\Software\Microsoft\Cryptography\MachineGuid; the Element variant stores its sealed config in HKLM\Software\synapse\Config\SealedConfig and its reporting interval in HKLM\Software\SynapseAgent\metrics_interval.

C2 behavior (HiveMQ): the agent queries http://ip-api.com/json to learn its public IP and country, publishes status ({online, hostname, timestamp, location}) to <cluster_id>/status, periodic CPU/memory/disk/load metrics to <cluster_id>/metrics3, polls <cluster_id>/cmd/req for {cmd_id, command, timeout_secs}, executes commands via PowerShell (-NonInteractive -NoProfile -Command) and returns stdout, stderr, exit_code and duration_ms to <cluster_id>/cmd/res. Encrypted config fields are agent_privkey, channel_id and server_pubkey. C2 behavior (Element): messages use custom types m.bird.status, m.bird.metrics and m.bird.cmd_response; commands come from the account 'panel-bot' with a 'cmd:' prefix for execution (via the Windows command line) and 'config:set_interval' (5-3600 s) to change the metrics interval; the access_token obtained after authentication is saved to a 'blob' field. Abusing a public broker and a messenger protocol lets C2 traffic blend with legitimate TLS traffic and complicates domain/IP blocking.

Kaspersky detection verdicts: HEUR:Backdoor.Win64.Suptoml.gen, HEUR:Trojan.Script.Zapchast.conf, Backdoor.Win64.Agent.smgdvy, Trojan.Script.Zapchast.abwm, Trojan.Win64.Agent.smgsfo, Trojan.Script.Zapchast.abwo. The source does not list CVEs, CVSS, victim sectors or MITRE techniques; severity is analyst-assigned. Prior public reporting (F6, via The Hacker News, 2026-03-27) describes Bearlyfy as having conducted 70+ attacks on Russian companies since January 2025, using exploitation of external services and vulnerable applications for access, and noting MeshAgent, a modified PolyVice ransomware (from May 2025) and GenieLocker (from March 2026).

## MITRE ATT&CK

- T1583.001 Domains
- T1588.002 Tool
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1543.003 Windows Service
- T1036.004 Masquerade Task or Service
- T1027 Obfuscated Files or Information
- T1112 Modify Registry
- T1070.004 File Deletion
- T1082 System Information Discovery
- T1021.006 Windows Remote Management
- T1102.002 Bidirectional Communication

## Sources

- [Angry Birds: Toy Ghouls' new toys](https://securelist.com/toy-ghouls-new-hivemq-and-element-backdoors/121270/)
- [Bearlyfy Hits 70 Russian Firms with Custom GenieLocker Ransomware](https://thehackernews.com/2026/03/bearlyfy-hits-70-russian-firms-with.html)
- [Toy Ghouls Targets Russian Organizations With New Windows Backdoors](https://hackread.com/toy-ghouls-russia-windows-backdoors/)
- [Toy Ghouls adopts HiveMQ, Element for Windows backdoors](https://thearabianpost.com/toy-ghouls-adopts-hivemq-element-for-windows-backdoors/)
- [Hackers Use Popular Messaging Services to Control New Windows Backdoors](https://www.cryptika.com/hackers-use-popular-messaging-services-to-control-new-windows-backdoors/)
- [Ransomware group Bearlyfy targeting Russia and Ukraine (The Record)](https://therecord.media/ransomware-ukraine-russia-bearlyfy)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4506