Loading story…
Financially motivated threat group Toy Ghouls—also tracked as Bearlyfy, Laboo.boo, and Feral Wolf—deployed two proprietary Windows backdoors against Russian organizations: mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0. The malware provides remote command execution, host-telemetry collection, and persistence through Windows service installation. Operators delivered the payloads remotely through WinRM using Evil-WinRM and WinRM-fs.
mqtt-bird-agent uses the legitimate public HiveMQ MQTT broker for command-and-control, while matrix-bird-agent communicates with an attacker-controlled Matrix/Element server at meet.element[.]tw. The MQTT variant encrypts machine-bound configuration data with ChaCha20-Poly1305 using the Windows MachineGuid value, whereas the Matrix variant stores configuration in the registry after execution. The tooling reflects the group's shift from public tools and leaked Babuk and LockBit ransomware builders toward bespoke malware, following its use of GenieLocker ransomware.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Additional analysis identified the HiveMQ variant as cplsupport.exe and the Element variant as wtass.exe, along with their persistence service names, configuration locations, C2 behavior, and sample MD5 hashes. The HiveMQ variant uses machine-bound ChaCha20-Poly1305-protected configuration and broker.hivemq.com, while the Element variant stores configuration in the registry and communicates through meet.element[.]tw using the panel-bot account.
In early July 2026, researchers first observed Toy Ghouls using proprietary Windows backdoors: mqtt-bird-agent 0.1.0, which uses the HiveMQ MQTT broker, and matrix-bird-agent 0.1.0, which uses the attacker-controlled Matrix/Element server meet.element[.]tw. The group delivered the payloads via WinRM using Evil-WinRM and WinRM-fs; both variants support telemetry collection, command execution, and Windows-service persistence.
Since at least January 2025, Toy Ghouls has accessed Russian organizations through compromised contractors, exposed services, valid RDP/OpenVPN/SSH credentials, and insecure 1C:Enterprise servers abused with the 1C-Shell EPF tool. The group used RedAlert and LockBit 3.0 against Windows systems and Babuk against Linux, ESXi, and NAS devices; researchers found no evidence of data exfiltration or a leak site.
The financially motivated Toy Ghouls group, also tracked as Bearlyfy, Laboo.boo, and Feral Wolf, began targeting Russian organizations.
Toy Ghouls later adopted its own ransomware, GenieLocker, marking a move away from reliance on public and leaked ransomware tooling.
Toy Ghouls initially used tools from public GitHub repositories and leaked Babuk and LockBit ransomware builders in its operations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 46 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
8 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourceinfosec.pub
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcemalware.news
Open sourcesecurelist.ru
Open sourcesecurelist.com
Open sourcesecurelist.ru
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that a ransomware group tracked as **Crypt Ghouls** targeted Russian businesses and government agencies across mining, energy, finance, retail, and public-sector organizations. The group reportedly gained initial access through compromised contractor VPN credentials, then established persistence with **NSSM** and **Localtonet**, harvested credentials using **XenAllPasswordPro** and **Mimikatz**, and expanded access with reconnaissance and lateral-movement tools including **PingCastle**, **SoftPerfect Network Scanner**, **WMI**, **Impacket** `WmiExec.py`, and **PAExec`. The attackers deployed **LockBit 3.0** on Windows systems and **Babuk** on Linux and **ESXi** environments, indicating a multi-platform ransomware capability. Researchers also found overlaps in tooling, infrastructure, and tactics with activity linked to **MorLock**, **BlackJack**, **Twelve**, and **Shedding Zmiy/(Ex)Cobalt**, suggesting collaboration, shared tooling, or intelligence exchange among multiple groups focused on Russian targets.
Jun 29, 2026
Feral Wolf compromised Russian retail, construction, manufacturing, and IT organizations from May through August 2026, ultimately encrypting data with **GenieLocker** ransomware. Initial access paths included exploitation of Atlassian Confluence vulnerability `CVE-2023-22515`, insecure internet-exposed 1C:Enterprise cluster configurations, and compromised contractor infrastructure; the operators also moved from containers to hosts, abused weak PostgreSQL credentials, and dumped LSASS memory to obtain credentials. BI.ZONE identified three previously unknown Feral Wolf tools: **MQTTDoor**, **MatrixDoor**, and **RDPSocksProxy**. MQTTDoor and MatrixDoor are Rust-based Windows service backdoors that use ostensibly legitimate MQTT and Matrix communications for encrypted command-and-control, with ChaCha20-protected data tied to the victim host's `MachineGuid`; RDPSocksProxy tunnels traffic through RDP. The group used these tools alongside anti-forensic cleanup to conceal persistence, lateral movement, and data-encryption operations.
Sep 20, 2026
Researchers linked the GitHub operator **`evilgrou-tech`** to the **WaterHydra/DarkCasino** lineage and uncovered an active malware operation using **DarkMe RAT**, **QuasarRAT v1.4.1**, and a modified **"Sentinel"** QuasarRAT variant against forex traders and cryptocurrency users. The attribution rests on a reused developer artifact — **`C:\Users\Administrator\Desktop\vaeeva\shellrundll.tlb`** — along with dozens of overlapping indicators spanning code, infrastructure, targeting, and tradecraft. The campaign used GitHub-hosted encrypted payloads, multi-stage loaders, AMSI bypasses, fileless .NET execution, registry and startup persistence, and live command-and-control nodes including **`91.124.98.29:2626`** and **`192.109.200[.]147`**. Investigators recovered five AES payload key schemes, an XOR loader key, and QuasarRAT PBKDF2-derived cryptographic material, enabling offline decryption of staged payloads and configuration data. The infrastructure mapped the operation across hosting providers and networks in Ukraine, Russia, and the United States, with ties to **ThinkHuge**, **PrefixBroker**, **PFCLOUD**, and upstream infrastructure associated with **CountLoader** and an **Amadey** staging server linked to more than 23 malware families. The **Sentinel** variant added **Hidden VNC**, keylogging, and browser credential theft under a crypto-focused **"Pumpfun"** campaign, while the parallel **"Office04"** activity remained focused on financial trading targets. Separate analysis of the live QuasarRAT server showed its encryption key matched the SHA1 hash of the server TLS certificate, but a protocol-accurate fake client was still rejected, indicating application-layer IP allowlisting on the C2. Breakglass also identified a second, distinct malware distribution operation tied to a Brazilian Portuguese-speaking actor that used fake gaming cheat sites, GitHub, Discord, and MediaFire to spread **AgentTesla**, underscoring broader criminal use of the same malware delivery ecosystem.
Jun 29, 2026