Hackers Turn HiveMQ and Element Messenger Into Control Channels for Windows Backdoors

Gbhackers •Mayura Kathir • September 4, 2026

The financially motivated threat actor Toy Ghouls has expanded its custom malware arsenal with two Windows backdoors that abuse HiveMQ’s public MQTT infrastructure and the Matrix-based Element messaging ecosystem for command-and-control communications. The development marks a notable evolution for the group, which previously leaned on publicly available tools and leaked ransomware builders before introducing its […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Toy Ghouls Use HiveMQ and Element for New Windows Backdoors The financially motivated group Toy Ghouls has introduced two new Windows backdoors named mqtt-bird-agent and matrix-bird-agent, utilizing HiveMQ and Element messenger for command-and-control communications. This marks a shift from their previous reliance on public tools and ransomware builders. The backdoors are delivered via Windows Remote Management (WinRM) using tools like Evil-WinRM and WinRM-fs. They can establish persistence as Windows services and accept both encrypted and unencrypted configuration files. The backdoors employ ChaCha20-Poly1305 encryption for configuration files, binding them to specific machines. The group has been active since 2025, primarily targeting Russian organizations. Current activity was first observed in July 2026, indicating an escalation in their tactics. 3 sources 66

Extracted Entities

Hackers Turn HiveMQ and Element Messenger Into Control Channels for Windows Backdoors

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (2)