Hackers Use Popular Messaging Services to Control New Windows Backdoors

Cybersecuritynews •Tushar Subhra Dutta • September 4, 2026

A financially motivated threat group known as Toy Ghouls has begun using two custom Windows backdoors that communicate through popular messaging and broker services. The tools give attackers a discreet way to run commands, collect system details, and maintain control over compromised devices. The campaign marks a change for the group, which had previously relied […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Toy Ghouls Use HiveMQ and Element for New Windows Backdoors The financially motivated group Toy Ghouls has introduced two new Windows backdoors named mqtt-bird-agent and matrix-bird-agent, utilizing HiveMQ and Element messenger for command-and-control communications. This marks a shift from their previous reliance on public tools and ransomware builders. The backdoors are delivered via Windows Remote Management (WinRM) using tools like Evil-WinRM and WinRM-fs. They can establish persistence as Windows services and accept both encrypted and unencrypted configuration files. The backdoors employ ChaCha20-Poly1305 encryption for configuration files, binding them to specific machines. The group has been active since 2025, primarily targeting Russian organizations. Current activity was first observed in July 2026, indicating an escalation in their tactics. 3 sources 66

Extracted Entities

Hackers Use Popular Messaging Services to Control New Windows Backdoors

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (3)

Platforms (1)