[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiMJitmvIV-78BZw8kD0QzRXQEQscdKR-8YWluJsm12o":3},{"article":4,"iocs":52,"watch_terms":62,"solutions":63,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"17fb4af0-9f1c-4022-b241-d92b9bbd6448","Angry Birds: Toy Ghouls’ new toys","angry-birds-toy-ghouls-new-toys-9fe6be","Kaspersky GERT experts have discovered new backdoors used by the Toy Ghouls group. One version of the backdoor uses the HiveMQ MQTT broker as its command-and-control server; the other uses the Matrix-based Element messenger.","Kaspersky GERT has identified new backdoors deployed by the financially motivated threat group Toy Ghouls, which targets Russian organizations. The group, also known as Bearlyfy, Laboo.boo, and Feral Wolf, has evolved from using leaked ransomware builders to custom variants like GenieLocker and now these new backdoors. One version of the backdoor, named 'mqtt-bird-agent', uses HiveMQ MQTT broker for command and control, while the other, 'matrix-bird-agent', utilizes the Element messenger for C2 communication.","Toy Ghouls group uses new backdoors leveraging HiveMQ MQTT or Element messenger for C2.","https:\u002F\u002Fsecurelist.com\u002Ftoy-ghouls-new-hivemq-and-element-backdoors\u002F121270\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F09\u002F04075246\u002Ftoy-ghouls-birds-backdoor-featured-image-scaled.jpg","2026-09-04T10:00:05+00:00","2026-09-04T12:00:15.383673+00:00",8,[17,20,22,24,26,29],{"name":18,"type":19},"Toy Ghouls","threat_actor",{"name":21,"type":19},"Bearlyfy",{"name":23,"type":19},"Laboo.boo",{"name":25,"type":19},"Feral Wolf",{"name":27,"type":28},"HiveMQ MQTT broker","product",{"name":30,"type":28},"Element messenger","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[53,56,59],{"type":51,"value":54,"context":55},"mqtt-bird-agent","HiveMQ C2 backdoor name",{"type":51,"value":57,"context":58},"matrix-bird-agent","Element messenger C2 backdoor name",{"type":51,"value":60,"context":61},"GenieLocker","Custom ransomware used by Toy Ghouls",[27,30],{"controls":64,"vendors":151},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":95,"name":96,"problem":97,"products":98},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"slug":35,"name":124,"problem":125,"products":126},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[],{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":167},"toy-ghouls-deploy-mqtt-and-matrix-based-backdoors-against-russian-orgs","Toy Ghouls Deploy MQTT and Matrix-Based Backdoors Against Russian Orgs","The Toy Ghouls threat group has significantly evolved its tooling, moving from commodity leaked ransomware builders to custom backdoors that abuse legitimate messaging infrastructure — specifically the HiveMQ MQTT broker and the Element messenger — for command and control communications. This matters because using trusted, widely-adopted protocols and platforms allows malicious C2 traffic to blend seamlessly with normal network activity, making detection extremely difficult with standard signature-based tools. Organizations that lack deep packet inspection, behavioral analytics, or strict egress filtering will likely miss these communications entirely. The group's evolution also signals increasing operational sophistication, meaning defenders must continuously reassess their threat models rather than relying on static indicators of compromise.",[157,158,159,160,161,162,163,164,165,166],"CIS Control 9 – Email and Web Browser Protections","CIS Control 12 – Network Infrastructure Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-53 SC-7 – Boundary Protection","NIST SP 800-53 AC-17 – Remote Access","MITRE ATT&CK T1071.001 – Application Layer Protocol: Web Protocols","MITRE ATT&CK T1102 – Web Service (C2 via legitimate external services)","NIST CSF DE.CM-1 – Network Monitoring","NIST CSF RS.AN-1 – Incident Investigation",{}]