Do Son 
At a glance
| Actor or group | Toy Ghouls (aka Bearlyfy, Labubu, Laboo.boo, Feral Wolf) |
| Activity type | Custom backdoor deployment, financially motivated extortion |
| Targets | Russian organizations, including industry and manufacturing |
| Scale | Not disclosed; active campaign since 2025 |
| Attribution status | Attributed by Kaspersky; no criminal charges reported |
| Source | Kaspersky Securelist |
TL;DR
Toy Ghouls added a custom backdoor to its toolkit for the first time. It ships in two builds that route command-and-control through HiveMQ and Element. Both give the group full remote control over infected Windows machines.
What happened
Kaspersky tracks Toy Ghouls, a financially motivated group active against Russian targets since 2025. The group once relied only on public GitHub tools and leaked Babuk and LockBit builders. Later, it moved to custom ransomware called GenieLocker. In early July 2026, researchers saw it use a custom backdoor for the first time.
The team found two versions, both carrying “bird” in their names. One is mqtt-bird-agent, which uses the HiveMQ broker. The other is matrix-bird-agent, which uses Element.
How the backdoor arrives
The attackers deliver the malware over Windows Remote Management. According to Kaspersky, “the group relies on open-source tools such as Evil-WinRM and WinRM-fs to do this.” The backdoor then installs itself as a Windows service for persistence.
How it hides its settings
The Toy Ghouls backdoor encrypts sensitive config fields with ChaCha20-Poly1305. The key comes from the machine’s registry GUID. As a result, “the configuration file becomes bound to that specific machine.” If the config cannot be decrypted, the backdoor stops running.
How the C2 channels work
At startup, both versions query ip-api.com to learn the host’s public IP and country. After that, each build talks to a different C2 service.
HiveMQ version
The MQTT build connects to the public broker broker.hivemq.com. It posts system status and metrics to topic paths tied to a cluster ID. Commands come back as JSON, and the backdoor runs them through hidden PowerShell.
Element version
The Matrix build connects to meet.element[.]tw, a server the attackers control. They created a room to receive device data and send commands. Kaspersky traced the operator account to the name panel-bot. This version runs commands through the Windows command line instead.
Who is behind it
Kaspersky attributes the backdoor to Toy Ghouls with moderate confidence. The group also goes by Bearlyfy, Labubu, Laboo.boo, and Feral Wolf. No law enforcement charges have been reported. Therefore, all activity remains at the “suspected” and “attributed” stage, not proven in court.
Impact and scale
Kaspersky has not published a victim count for this backdoor campaign. Still, the group’s shift to custom tooling signals a rising threat. Custom code helps it dodge detection and stay hidden longer.
How to stay protected
Defenders should watch for Evil-WinRM and WinRM-fs activity on Windows hosts. Also monitor outbound traffic to public MQTT brokers and unknown Matrix servers. Restrict WinRM where it is not needed. Finally, hunt for services that launch hidden PowerShell with the -NonInteractive -NoProfile flags.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
