Toy Ghouls adopts HiveMQ, Element for Windows backdoors

Cybercriminals known as Toy Ghouls have introduced two specialized Windows backdoors that utilize HiveMQ and the Matrix-based Element messaging system for command-and-control operations, representing a shift towards specialized malware. Researchers reported observing these tools, named mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0, for the first time in early July.

Toy Ghouls, also recognized as Bearlyfy, Laboo. boo, and Feral Wolf, has been targeting entities in Russia with a focus on financial gain. The HiveMQ variant communicates via the public broker at broker.hivemq.com to exchange data and commands with compromised machines, while the Element version operates through a controlled Element server on the Matrix protocol.

Both tactics enable illicit traffic to merge with legitimate traffic involving those technologies, potentially complicating network-based detection. The campaign distributes the backdoors and their configuration files through Windows Remote Management, employing open-source utilities like Evil-WinRM and WinRM-fs. Upon execution, the malware can operate interactively or embed itself as a Windows service to retain access after a system restart.

The HiveMQ version disguises itself as a service named cplsupport, labeled as "Problem Reports Control Panel," whereas the Element version uses the service name wtas and the display name "Windows Telemetry Aggregator Service." These names are crafted to mimic standard Windows components to minimize suspicion during routine inspections.

Both versions also safeguard their configuration data. The HiveMQ backdoor can partially encrypt its configuration using ChaCha20-Poly1305, deriving the key from the Windows MachineGuid value, ensuring the protected information is bound to the infected computer. Conversely, the Element version deletes its original configuration file post-initial execution and stores encrypted data in the Windows registry.

Upon startup, the malware retrieves the infected system's public IP address and country information from ip-api.com. The HiveMQ variant subsequently reports status and system metrics, encompassing processor load, memory usage, disk consumption, and uptime, through designated channels on the broker. Commands obtained via HiveMQ are executed via PowerShell in hidden, non-interactive mode.

The backdoor relays the output, error output, exit code, and execution time back through the same command infrastructure, enabling operators to remotely control the host and review results. The Matrix-based variant adopts a similar procedure but transmits data through an Element room. It conveys status and performance metrics as Matrix messages and accepts commands starting with "cmd:".

Investigators analyzing local Element databases on compromised systems identified "panel-bot" as the account utilized to issue directives. This version can also accept configuration messages that modify the interval for transmitting system metrics, with allowable values ranging from five to 3,600 seconds. Received commands are executed through the Windows command-line interface, and the output is transmitted to the attackers as a separate Matrix message.

The research reveals Toy Ghouls distancing themselves from their previous reliance on publicly available offensive tools and leaked ransomware builders. The group had previously employed leaked Babuk and LockBit builders before creating its own GenieLocker ransomware, according to researchers tracking their activities. The two backdoors augment this evolution by offering operators persistent remote-control capabilities instead of solely depending on ransomware deployment.

The use of unconventional command channels may enable the group to sustain malicious communication while making it less conspicuous amidst legitimate network traffic. HiveMQ is a legitimate MQTT technology provider, and Element is a communication platform built on the open Matrix protocol. The findings do not imply that either service was itself compromised; instead, the attackers exploited accessible or independently controlled infrastructure linked to those technologies for malicious communications.