Loading malware…
matrix-bird-agent is a proprietary Windows backdoor used by the financially motivated Toy Ghouls group, also tracked as Bearlyfy, Laboo.boo, and Feral Wolf, against Russian organizations. Observed in July 2026, it uses the Element client and Matrix protocol for command-and-control communications with attacker-controlled infrastructure. The backdoor can operate interactively or establish persistence as a Windows service, report host status and system telemetry, obtain the host's public network location, receive configuration updates, execute commands through the Windows command shell, and return command output through Matrix messages. Toy Ghouls deployed it to previously compromised Windows systems using Windows Remote Management tooling. Following initial execution, the backdoor removes its configuration file and retains configuration data in the Windows registry.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
matrix-bird-agent 0.1.0 (Element version)... For the second backdoor version, the attackers set up their own Element server running on the Matrix protocol... as the C2 server.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A custom Toy Ghouls Windows backdoor that uses an attacker-controlled Matrix/Element server and room for C2. It persists as a Windows service, stores its configuration in the registry after first execution, sends system status and metrics, accepts interval changes, and executes cmd: commands through the Windows command line.
A Windows backdoor used by Toy Ghouls that can persist as a service, stores its sealed configuration in the registry, sends system status and metrics through a Matrix room, receives configuration or command messages, executes commands via the Windows command shell, and reports results to the room.
A custom Windows backdoor used by Toy Ghouls that persists as a Windows service and uses a Matrix/Element server for command-and-control. It stores its sealed configuration in the registry, reports status and host metrics to a Matrix room, accepts metric-interval changes, and executes cmd: commands through the Windows command-line interface.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.