A ransomware crew that used to run entirely on other people's tools has started writing its own, and the first thing it built talks to its operators through a chat room.
Kaspersky's GERT incident response team and Kaspersky Security Services report that Toy Ghouls, a financially motivated group also tracked as Bearlyfy, Laboo.boo and Feral Wolf, deployed a custom backdoor for the first time in early July 2026. The group has been attacking Russian organizations since 2025, initially with nothing more than public GitHub tooling and the leaked Babuk and LockBit ransomware builders, before moving to its own encryptor, GenieLocker.
The new backdoor comes in two versions, and both of them left the developers' naming convention in the binary. One is mqtt-bird-agent, the other matrix-bird-agent.
Two free services doing the work of a C2 server
Neither version phones home to infrastructure the group has to rent, register or defend. The first uses broker.hivemq.com, the public test broker for the HiveMQ message queueing service, whose free tier allows up to 100 simultaneous connections and 10 GB of traffic a month. The attackers set up their own cluster on it and used it both to collect status reports from infected machines and to push commands back down.
The second version talks to a Matrix server the attackers control, using the Element messenger. The backdoor registers itself, joins a room, and waits. Kaspersky pulled the operators' account name straight out of Element's SQLite databases on a compromised host: panel-bot. Commands arrive in that room as messages beginning with cmd: and are run through the Windows command line, with the output posted back as a reply. A second message type, config:set_interval, changes how often the implant reports in, anywhere from 5 seconds to an hour.
For a defender watching outbound traffic, both channels look like ordinary use of a legitimate service. That is the point of choosing them.
The configuration file locks itself to the machine
The backdoor installs as a Windows service, disguised as something dull enough to skip past a services list: cplsupport, described as "Problem Reports Control Panel", or wtas, described as "Windows Telemetry Aggregator Service". It is delivered over Windows Remote Management using the open-source Evil-WinRM and WinRM-fs tools.
On first run it reads a config.toml file and encrypts the sensitive parts of it in place with ChaCha20-Poly1305, deriving the key from the machine's own MachineGuid registry value. That binds the configuration to that one computer. Copy the file to an analyst's machine and it will not decrypt, and the backdoor simply stops rather than running without it. The Element version goes further and deletes the file entirely after the first run, keeping its settings in the registry instead. Both versions check in with a public geolocation service on startup to learn the victim's external address and country.
Why the shift to custom tools matters
Kaspersky frames this as a group deliberately maturing. Toy Ghouls has moved from public repositories and leaked builders to a custom encryptor, and now to a custom backdoor that gives it full control of an infected device through channels most monitoring will not flag. The researchers assess the aim is to make attacks harder to spot and to stay inside networks for longer. IntelFusions covered the same crew when its GenieLocker encryptor first hit Russian factories in July, and the pattern of activity against Russian targets has continued since.
What to look for
There is no patch here, so detection is the answer. Kaspersky's full write-up lists the indicators; the most useful are the service names and registry keys, since the file names change.
- Services named cplsupport or wtas, and executables cplsupport.exe (MD5 bfadbeee63a4f0bf19ec9deb8fa58f58) or wtass.exe (MD5 7916c33688385525078bee504c90f359)
- Registry keys HKLM\Software\synapse\Config\SealedConfig and HKLM\Software\SynapseAgent\metrics_interval
- A config.toml file in %PROGRAMDATA%\SynapseAgent\ or %PROGRAMDATA%\cplsupport\
- Attacker Matrix server meet.element[.]tw, plus traffic to broker.hivemq[.]com and ip-api[.]com, both legitimate services being abused here
Blocking a public MQTT broker outright is realistic for most enterprises, because almost nothing on a corporate desktop has a reason to reach one. A Matrix server is harder, and that is probably why the second version exists.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.