If you saw a Windows machine on your network quietly talking to broker.hivemq.com, would you even blink? Probably not — MQTT brokers are everywhere in IoT, smart buildings, and dev pipelines. That's exactly the blind spot a financially motivated threat group called Toy Ghouls is now exploiting, according to research from Kaspersky's Global Emergency Response Team (GERT).
For the first time since it emerged in 2025, Toy Ghouls has ditched its usual toolkit of public GitHub scripts and leaked ransomware builders (previously Babuk and LockBit, later its own GenieLocker ransomware) for two custom-built Windows backdoors. One talks to operators over a legitimate MQTT broker. The other hides inside an Element/Matrix chat room. Neither platform is hacked or vulnerable — they're used exactly as designed, just by the wrong people.
This is a textbook case of "living-off-trusted-services" — a pattern more devs and SREs should understand, since it targets the same infra you're probably already running in prod.
The Backdoors: mqtt-bird-agent and matrix-bird-agent
Kaspersky identified two builds (v0.1.0), sharing the same "phone home, execute commands" design:
mqtt-bird-agent connects to the public HiveMQ broker, reports system telemetry (CPU, memory, online status), and pulls attacker instructions that run through a hidden PowerShell process.
matrix-bird-agent connects to an attacker-controlled Element server, posts status to a chat room, and receives commands from an account named panel-bot, executed via the Windows command line.
Both grant full remote control and can run in-memory or install as a persistent Windows service. If MQTT-based C2 sounds familiar, it echoes earlier tactics from the WailingCrab malware family — but Toy Ghouls' choice of infrastructure is deliberately built to blend into normal enterprise/IoT noise.
Delivery: WinRM Abuse, Not a Zero-Day
These backdoors are second-stage payloads, not the initial breach. Kaspersky found Toy Ghouls pushing binaries and config files to already-compromised hosts via Windows Remote Management (WinRM), using Evil-WinRM and WinRM-fs.
WinRM is a completely legitimate admin protocol — which is exactly why malicious use hides so well inside routine remote-admin traffic.
Persistence: Disguised as Everyday Services
Both variants can install as Windows services to survive reboots:
- HiveMQ variant → registers as cplsupport, shown as "Problem Reports Control Panel"
- Element variant → registers as wtas, shown as "Windows Telemetry Aggregator Service"
Neither is a real default Windows service, but both are plausible enough to slip past a quick services.msc scan.
Anti-Forensics: Machine-Bound Encryption
Sensitive fields in config.toml are encrypted with ChaCha20-Poly1305, with the key derived from the host's MachineGuid registry value — so the file won't decrypt outside the infected machine without that value too.
The Element variant goes further: after first use, it deletes config.toml entirely and moves settings into the registry, minimizing forensic artifacts. Both variants query ip-api.com at startup to fingerprint the victim's public IP and country.
Indicators of Compromise
| Type | Indicator | Notes |
|---|---|---|
| File | cplsupport.exe |
HiveMQ backdoor |
| Hash | BFADBEEE63A4F0BF19EC9DEB8FA58F58 |
cplsupport.exe |
| File | wtass.exe |
Element backdoor |
| Hash | 7916C33688385525078BEE504C90F359 |
wtass.exe |
| Registry | HKLM\Software\synapse\Config\SealedConfig |
Sealed Element config |
| Service |
cplsupport / wtas
|
Disguised persistence |
| Domain | broker.hivemq[.]com |
Abused, not compromised |
| Domain | meet.element[.]tw |
Attacker-controlled |
Defang and validate all IOCs in your own threat intel platform before use.
Detection: What Actually Works
Blocklists won't catch this — HiveMQ and Element are legitimate and will never show up on a malicious-domain list. Detection has to be behavior-based:
- Restrict WinRM to a short list of approved management hosts; alert on unusual sources
- Enable PowerShell Script Block Logging (Event ID 4104) and look for hidden PowerShell spawned by unexpected parents
- Monitor service creation (Event ID 7045) for generic names outside your baseline
- Flag outbound MQTT/Matrix traffic from servers — normal for IoT/dev boxes, abnormal for domain controllers or file servers
- Sweep
ProgramDatafor unexpected.tomlfiles - Enforce phishing-resistant MFA on privileged remote-admin accounts
A quick triage hunt for non-standard services:
Get-CimInstance -ClassName Win32_Service | Where-Object { $_.PathName -notlike "*Windows*" } | Select-Object Name, DisplayName, PathName, StartMode
Not a silver bullet — correlate results against your known-good service baseline.
Why This Matters for Devs, Not Just SOC Teams
If you build or maintain systems that use MQTT brokers, Matrix homeservers, or any chat-based integrations (Slack/Discord/Teams bots included), this campaign is a reminder that the same trust your app relies on can be weaponized against your infra. Attackers are increasingly abusing legitimate cloud/messaging services as C2 channels precisely because reputation-based blocking can't touch them. IOCs rotate build to build — the underlying behavior (WinRM-delivered payloads, disguised services, anomalous outbound traffic) is what stays constant.
FAQ
Is HiveMQ or Element compromised?
No. Both are legitimate, unaffected platforms being abused, not exploited.
Who is Toy Ghouls?
A financially motivated group (aliases: Bearlyfy, Laboo.boo, Feral Wolf) targeting Russian organizations since 2025, previously linked to GenieLocker ransomware.
Can this backdoor survive a reboot?
Yes, via disguised Windows services (cplsupport / wtas).
What should teams prioritize?
WinRM audits, PowerShell logging, service-creation monitoring, and outbound traffic baselining per host role.
Bottom Line
If your team hasn't reviewed WinRM access controls or audited for unfamiliar Windows services recently, this is a good reason to move it up the backlog. Trusted-looking traffic isn't automatically safe traffic.
Full technical write-up and source: Xpert4Cyber — Hackers Hide Windows Backdoor Inside HiveMQ and Element Chat, based on Kaspersky Securelist/GERT threat intelligence.
Top comments (0)