Hackers Use Popular Messaging Services to Control New Windows Backdoors
Brief
A financially motivated threat group known as Toy Ghouls has begun using two custom Windows backdoors that communicate through popular messaging and broker services.
The tools give attackers a discreet way to run commands, collect system details, and maintain control over compromised devices.
The campaign marks a change for the group, which had previously relied heavily on public tools and leaked ransomware builders.
Its move to custom malware suggests a broader effort to stay inside victim networks longer while making activity harder for security teams to spot.
Analysts at Securelist identified the malware in early July 2026 and linked it to Toy Ghouls, also tracked as Bearlyfy, Laboo. boo, and Feral Wolf. The group has targeted Russian organizations since 2025 and has previously been associated with its own GenieLocker ransomware.
The new backdoors are called mqtt-bird-agent 0. 1.