Hackers Turn HiveMQ and Element Messenger Into Control Channels for Windows Backdoors

The financially motivated threat actor Toy Ghouls has expanded its custom malware arsenal with two Windows backdoors that abuse HiveMQ’s public MQTT infrastructure and the Matrix-based Element messaging ecosystem for command-and-control communications.

The development marks a notable evolution for the group, which previously leaned on publicly available tools and leaked ransomware builders before introducing its own GenieLocker ransomware family.

Also tracked as Bearlyfy, Laboo.boo and Feral Wolf, Toy Ghouls has targeted Russian organizations since 2025.

Researchers first observed the new custom backdoors in early July 2026, identifying builds named mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0.

The former communicates through the HiveMQ MQTT broker, while the latter uses an attacker-controlled Element/Matrix server.

The approach indicates that the operators are likely deploying the payloads after obtaining valid administrative access rather than relying on broad phishing-based distribution.

Both variants can run interactively or register themselves as persistent Windows services. The HiveMQ sample, observed as cplsupport.exe, supports --install, --uninstall and --seal options.

The Element version, observed as wtass.exe, includes install, uninstall, and an internal service command used by the installed Windows service.

The HiveMQ implant searches first for config.toml in its execution directory and then for %PROGRAMDATA%cplsupportconfig.toml.

The Matrix variant similarly falls back to %PROGRAMDATA%SynapseAgentconfig.toml. This gives the operators flexibility to stage the implant in temporary locations before moving it into a persistent system-wide path.

A key technical feature is the use of machine-bound configuration encryption.

Securelist Researchers said that, Toy Ghouls deploys the backdoors and their accompanying config.toml files through Windows Remote Management (WinRM), using open-source post-exploitation utilities including Evil-WinRM and WinRM-fs.

The HiveMQ backdoor can encrypt sensitive configuration values with ChaCha20-Poly1305, deriving its key from the Windows HKLMSoftwareMicrosoftCryptographyMachineGuid registry value.

HiveMQ Powers Backdoor

That mechanism binds the encrypted configuration to the compromised host: copying the file to another system prevents it from being decrypted successfully. If the malware cannot recover the configuration, it terminates.

The protected values include the agent private key, broker channel identifier, and server public key.

The Element variant takes persistence further. After its initial execution, it deletes its configuration file and stores the relevant encrypted data in HKLMSoftwaresynapseConfigSealedConfig.

Its settings include the attackers’ Element server, a Matrix room ID, and an access token used to authenticate to that room.

Both versions contact ip-api.com/json at startup to collect the victim host’s public IP address and geographical information.

The MQTT version then connects to broker.hivemq.com over port 8883, using a cluster controlled by the attackers to exchange status reports, system telemetry, commands, and command results.

The implant reports hostname, online state, timestamp, public-IP location data, CPU consumption, memory usage, disk usage, system load, and uptime.

It polls a command endpoint, executes received instructions with hidden PowerShell using -NonInteractive -NoProfile -Command, and returns standard output, error output, execution time, and exit codes.

The Element-based version uses the Matrix server meet.element[.]tw and a dedicated room as its control channel. It sends custom events such as m.bird.status, m.bird.metrics, and m.bird.cmd_response.

Operators can change telemetry intervals between five and 3,600 seconds through config:set_interval messages, which are saved under HKLMSoftwareSynapseAgentmetrics_interval.

Commands prefixed with cmd: are executed through the Windows command shell; researchers identified panel-bot as the account used to dispatch commands.

The backdoors provide operators with durable remote access, host monitoring, and arbitrary command execution capabilities that can support reconnaissance, lateral movement, payload staging, and ransomware deployment.

Their discovery follows Toy Ghouls’ shift to the in-house GenieLocker ransomware, which targets Windows, Linux, and VMware ESXi environments.

For defenders, suspicious WinRM activity, newly created services, reads or writes involving the SynapseAgent and cplsupport ProgramData directories, access to the identified registry paths, and unexpected MQTT or Matrix traffic warrant immediate investigation.

The use of familiar cloud and messaging infrastructure can make C2 traffic blend into legitimate activity, raising the importance of behavioral detection rather than domain-only blocking.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.