Toy Ghouls Deploys Windows Backdoors Over MQTT and Matrix
Kaspersky details Toy Ghouls backdoors that use HiveMQ MQTT and Matrix-based Element for Windows persistence, telemetry, and command execution.
Kaspersky researchers have identified two custom Windows backdoors used by Toy Ghouls, a financially motivated group that has targeted Russian organizations since 2025. The tools use communication channels that can blend into legitimate services: one relies on the HiveMQ MQTT broker, while the other uses a Matrix server accessed through Element.
The findings come from Securelist, where Kaspersky GERT and Kaspersky Security Services describe the delivery, installation, configuration handling, telemetry, and command execution features of both implants. The research indicates that Toy Ghouls has moved beyond its earlier reliance on publicly available tools and leaked ransomware builders toward custom-developed components.
Two backdoors, one operational pattern
Kaspersky identified the tools as mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0. The names reflect their respective command-and-control designs rather than two unrelated campaigns.
The HiveMQ variant uses cplsupport.exe and communicates through the public broker at broker[.]hivemq[.]com. The Element variant uses wtass.exe and connects to an attacker-controlled Matrix service at meet[.]element[.]tw. Kaspersky describes the HiveMQ broker as a legitimate resource abused by the attackers; its presence alone should therefore not be treated as proof of compromise.
Both tools can operate interactively when launched from a command shell, but they are also designed to establish persistence as Windows services. The HiveMQ build accepts an --install option, while the Element build uses an install command. Their service-oriented design gives the operators a durable foothold that can survive ordinary user-session changes and support later command execution.
Delivery and installation
According to Kaspersky, the attackers delivered the backdoors and their configuration files through Windows Remote Management, or WinRM. The research specifically identifies the open-source tools Evil-WinRM and WinRM-fs as part of this delivery activity.
This sequence matters for defenders because the malicious executable may not be the first visible event. A review that begins only with endpoint malware alerts could miss the preceding remote-management activity, file transfer, or administrative-session abuse. WinRM usage should be assessed in the context of the initiating account, source host, timing, destination, and whether the activity is expected for that environment.
The backdoors look for a config.toml file in their launch directory. If it is not present there, the HiveMQ version checks %PROGRAMDATA%\cplsupport\config.toml, while the Element version checks %PROGRAMDATA%\SynapseAgent\config.toml. The tools also support an explicit configuration path.
Kaspersky reports that the HiveMQ version can encrypt sensitive configuration fields with its --seal option. The encryption uses ChaCha20-Poly1305 with a key derived from the Windows HKLM\Software\Microsoft\Cryptography\MachineGuid value. After the first run, the configuration is bound to that machine. The encrypted data includes the agent private key, channel identifier, and server public key.
The Element version handles configuration differently. It deletes the original configuration file after the first run and stores relevant values in HKLM\Software\synapse\Config\SealedConfig. Those values include the attacker’s Element server address, a room identifier, and an access token. Kaspersky says that if the access-token field is empty, the installer can request the password interactively; after a session is created, the resulting token is stored in the configuration blob.
These behaviors create useful investigation opportunities. Analysts should correlate service creation with changes under the reported registry paths, unusual files in the associated %PROGRAMDATA% locations, and configuration files that disappear shortly after execution.
How the backdoors communicate
At startup, both versions make a request to ip-api[.]com/json to determine the compromised system’s public IP address and country. Kaspersky characterizes this as a legitimate service used by cybercriminals. The lookup is therefore an investigative signal when it appears alongside the backdoor artifacts, but it is not independently conclusive.
The HiveMQ version establishes a connection to the attackers’ broker cluster. Kaspersky reports that the cluster is used both to collect information from compromised systems and to issue commands. The backdoor sends an online status containing the hostname, timestamp, and location data. At configured intervals, it sends system metrics including CPU usage, memory and disk capacity, load averages, uptime, hostname, and timestamp.
The implant then polls a command path for instructions. Commands returned by the server include an identifier, command text, and timeout value. The backdoor executes those commands through PowerShell.exe with hidden-window, noninteractive, and no-profile parameters. Standard output, standard error, exit status, and execution duration are returned to the command service.
The Matrix-based version follows a similar operational model but expresses the traffic as Matrix messages in an attacker-controlled room. It sends status data as an m.bird.status message and periodic host information as m.bird.metrics. The metrics fields are largely equivalent to those in the HiveMQ build, although Kaspersky notes differences in field naming and scaling.
This version supports a configuration command that changes the metrics interval. The accepted interval ranges from 5 to 3,600 seconds, and the chosen value is stored under HKLM\Software\SynapseAgent\metrics_interval. Execution requests begin with the cmd: prefix, and their output is sent back in an m.bird.cmd_response message. Kaspersky identified the Matrix account used to send commands as panel-bot through analysis of Element SQLite databases found on compromised systems.
What the findings establish—and what they do not
The confirmed technical findings are that the two backdoors can be delivered over WinRM, installed as Windows services, collect host and system information, communicate through HiveMQ or Matrix-based Element infrastructure, and execute operator-supplied commands. The research also documents the relevant filenames, service names, registry locations, domains, and hashes.
Kaspersky assesses that the shift toward custom backdoors represents an effort by Toy Ghouls to make its operations more sophisticated and remain undetected for longer. That is an assessment by the research organization, not a directly measurable conclusion about the success of every deployment. The report does not establish the number of affected organizations, the initial access method before WinRM use, or the precise business impact of each intrusion.
The supplied research also does not provide a CVE, a list of named victims, or a definitive explanation of how the attackers obtained the administrative access required for WinRM delivery. It does not publish a MITRE ATT&CK mapping. Accordingly, this analysis does not assign techniques or infer an exploitation path beyond what Kaspersky explicitly described.
Detection and threat-hunting priorities
Organizations should begin with endpoint and Windows administrative telemetry. Look for unexpected creation of services named cplsupport or wtas, particularly where the displayed service descriptions are “Problem Reports Control Panel” or “Windows Telemetry Aggregator Service.” Investigate executions of cplsupport.exe or wtass.exe, as well as suspicious config.toml files in the reported directories or adjacent launch locations.
Review registry activity involving:
HKLM\Software\synapse\Config\SealedConfigHKLM\Software\SynapseAgent\metrics_intervalHKLM\Software\Microsoft\Cryptography\MachineGuidwhen correlated with suspicious configuration processing
Network monitoring should examine unexpected connections to broker[.]hivemq[.]com, meet[.]element[.]tw, and ip-api[.]com. Because two of these are legitimate services or service-like infrastructure, detection should combine domain activity with process identity, service creation, registry changes, and unusual WinRM behavior rather than relying on domain blocking alone.
PowerShell telemetry is also important. Hunt for hidden, noninteractive PowerShell launched by an unfamiliar service executable, and compare command output channels with the initiating process. For the Matrix variant, review Element or Matrix client databases and authentication artifacts where that software is not sanctioned or expected.
Kaspersky’s published file indicators include the following MD5 hashes:
cplsupport.exe:BFADBEEE63A4F0BF19EC9DEB8FA58F58wtass.exe:7916C33688385525078BEE504C90F359
The report lists these Kaspersky detections: HEUR:Backdoor.Win64.Suptoml.gen, HEUR:Trojan.Script.Zapchast.conf, Backdoor.Win64.Agent.smgdvy, Trojan.Script.Zapchast.abwm, Trojan.Win64.Agent.smgsfo, and Trojan.Script.Zapchast.abwo. Hashes and verdict names should be used as supporting evidence, not as a substitute for behavioral investigation.
What organizations should do now
- Restrict WinRM to approved administration paths and review remote-management activity from unusual accounts, workstations, or geographic locations.
- Require strong authentication and least privilege for accounts permitted to use WinRM or create services.
- Alert on new services, especially those with misleading descriptions or binaries placed in unusual directories.
- Monitor PowerShell and command-line activity initiated by service processes, including hidden or noninteractive execution.
- Use DNS, proxy, firewall, and endpoint telemetry together to investigate the reported HiveMQ, Element, and IP-geolocation service domains.
- Preserve volatile and filesystem evidence before removing suspicious services or deleting configuration artifacts.
- Compare observed files and registry paths with the indicators published by Kaspersky, then conduct broader searches for related activity across the environment.
Blocking a single public service may be insufficient, particularly when the service is legitimate and shared by unrelated users. The stronger defensive approach is to identify the combination of remote delivery, service persistence, configuration storage, unusual process ancestry, and application-layer communications described in the research.
Conclusion
Toy Ghouls’ new backdoors demonstrate how familiar services can be repurposed for command and control without requiring an obviously dedicated malicious domain. Kaspersky’s analysis provides a practical detection model: investigate WinRM-based delivery, service installation, machine-bound configuration handling, registry persistence, host telemetry, and hidden command execution as one connected sequence. The available indicators can accelerate triage, while behavior-focused monitoring is more likely to identify variants or deployments that do not retain the same files and hashes.