11 minhigh
Angry Birds: Toy Ghouls’ new toys
Toy Ghouls has deployed two custom backdoor variants targeting Russian organizations via WinRM delivery. The backdoors use unconventional C2 channels — the public HiveMQ MQTT broker and a self-hosted Element/Matrix server — to receive commands and exfiltrate system telemetry. Both variants establish persistence as Windows services and employ machine-bound configuration encryption using ChaCha20-Poly1305 derived from the MachineGuid registry key.
Sens:▲ 24hConf:high
IOCs12
3registry key2filename2file path2md52url1domain
Detection / Hunteropenrouter
What Happened
A financially motivated hacking group called Toy Ghouls has built custom backdoor programs that give them full remote control over infected computers. They deliver these programs by exploiting a Windows remote management feature. The backdoors communicate with the attackers through unusual channels: an MQTT messaging service and a self-hosted chat server based on the Matrix protocol. Russian organizations are the primary targets. This matters because the group has moved from using publicly available hacking tools to building their own custom software, which makes them harder to detect. Organizations should check for the specific files, services, and registry keys associated with these backdoors and review whether Windows Remote Management is exposed unnecessarily.
Key Takeaways
- Toy Ghouls developed two custom backdoor variants (mqtt-bird-agent and matrix-bird-agent) using HiveMQ MQTT broker and Element/Matrix messenger for C2 communication, marking a shift from open-source tools to custom malware.
- Both backdoors establish persistence as Windows services and encrypt configuration files using ChaCha20-Poly1305 with a key derived from the MachineGuid registry value, binding configs to specific machines.
- Delivery is performed via Windows Remote Management (WinRM) using open-source tools Evil-WinRM and WinRM-fs.
- Commands are executed via PowerShell in hidden non-interactive mode, with results exfiltrated over the respective C2 channel.
- The Element version stores sealed configuration in the registry (HKLM\Software\synapse\Config\SealedConfig) and deletes the config file after first run, while the HiveMQ version keeps an encrypted config.toml on disk.
Affected Systems
- Windows systems with WinRM enabled
- Russian organizations targeted since 2025
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Attackers use WinRM (Evil-WinRM, WinRM-fs) to deliver backdoor binaries and configuration files to compromised Windows systems.
- Installation: Backdoor is installed as a Windows service using the --install option, creating services named 'cplsupport' or 'wtas'.
- Persistence & Config Sealing: Configuration file is encrypted using ChaCha20-Poly1305 with a key derived from MachineGuid; Element version migrates config to registry and deletes the file.
- C2 Communication: HiveMQ version connects to broker.hivemq.com:8883 over MQTT; Element version connects to meet.element.tw over Matrix protocol. System status and metrics are sent at configured intervals.
- Command Execution: C2 server sends commands which are executed via PowerShell in hidden non-interactive mode; results are exfiltrated back over the C2 channel.
- Reconnaissance: Both variants query ip-api.com at startup to determine the system's public IP and geolocation.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article provides Kaspersky AV verdicts (HEUR:Backdoor.Win64.Suptoml.gen, HEUR:Trojan.Script.Zapchast.conf, Backdoor.Win64.Agent.smgdvy, Trojan.Script.Zapchast.abwm, Trojan.Win64.Agent.smgsfo, Trojan.Script.Zapchast.abwo) but no YARA, Sigma, Snort, Suricata, KQL, SPL, or EQL rules.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can detect service creation, PowerShell execution in hidden mode, and registry modifications. However, the use of legitimate protocols (MQTT, Matrix) and legitimate-looking service names may reduce behavioral detection confidence. |
| Network Visibility | Medium | Connections to broker.hivemq.com:8883 and meet.element.tw are visible at the network layer. However, MQTT and Matrix are legitimate protocols that may not be flagged by default network monitoring. The ip-api.com query is also a legitimate service. |
| Detection Difficulty | Moderate | The backdoors use legitimate protocols and services for C2, which complicates network-based detection. However, the specific file names, service names, registry keys, and the combination of behaviors (WinRM delivery followed by service creation and MQTT/Matrix communication) provide multiple detection pivots. |
Required Log Sources
- Windows System event logs (service creation - Event ID 7045)
- Windows PowerShell script block logging (Event ID 4104)
- Windows process creation logs (Event ID 4688)
- Registry modification logs (Sysmon Event ID 13)
- DNS resolution logs
- Network connection logs (firewall, proxy, or NetFlow)
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for processes querying the MachineGuid registry key followed by file encryption activity, as both backdoor variants derive their config encryption key from this value. | Sysmon Event ID 13 (registry value set) for HKLM\Software\Microsoft\Cryptography\MachineGuid reads, correlated with file write events in %PROGRAMDATA% subdirectories. | Persistence / Defense Evasion | Medium — legitimate software may also read MachineGuid for licensing or identification purposes. |
| Consider hunting for newly created Windows services with names resembling legitimate Windows components (cplsupport, wtas) that were not present in baseline service inventories. | Windows System Event ID 7045 (service installed) and Sysmon Event ID 6 (driver loaded) or Event ID 1 (process creation) for service host processes. | Persistence | Low — the specific service names and display names used by this backdoor are not standard Windows services. |
| Consider hunting for PowerShell processes launched with -NonInteractive -NoProfile -Command arguments that are children of non-standard parent processes, as the backdoor executes commands this way. | Sysmon Event ID 1 (process creation) with parent-child process correlation, focusing on powershell.exe command line arguments. | Execution | Medium — administrative scripts and management tools may use similar PowerShell invocation patterns. |
| Consider hunting for outbound connections to broker.hivemq.com on port 8883 from non-IoT Windows endpoints, as this MQTT broker is used as a C2 channel by the HiveMQ backdoor variant. | Firewall logs, proxy logs, or DNS resolution logs showing connections to broker.hivemq.com from Windows workstations or servers. | Command and Control | Medium — legitimate IoT or development systems may connect to the public HiveMQ broker. |
| Consider hunting for registry values written under HKLM\Software\synapse\ or HKLM\Software\SynapseAgent\ on systems where Synapse software is not legitimately installed. | Sysmon Event ID 13 (registry value set) or Windows Event ID 4657 (registry value modified) for these specific registry paths. | Persistence | Low — these registry paths are specific to the backdoor and unlikely to exist on systems without the malware. |
Control Gaps
- Network-based detection may not flag MQTT or Matrix protocol traffic as suspicious since both are legitimate application-layer protocols.
- The use of a public MQTT broker (broker.hivemq.com) blends C2 traffic with legitimate IoT and development traffic.
- Configuration encryption using machine-bound keys prevents static analysis of config files after first run, limiting forensic extraction of C2 parameters.
- Service names mimicking legitimate Windows components (Problem Reports Control Panel, Windows Telemetry Aggregator Service) may evade allowlist-based service monitoring.
Key Behavioral Indicators
- Windows service creation with names 'cplsupport' or 'wtas' and display names 'Problem Reports Control Panel Support' or 'Windows Telemetry Aggregator Service'
- PowerShell execution with -NonInteractive -NoProfile -Command parameters spawned by cplsupport.exe or wtass.exe
- File writes to %PROGRAMDATA%\cplsupport\config.toml or %PROGRAMDATA%\SynapseAgent\config.toml
- Registry writes to HKLM\Software\synapse\Config\SealedConfig or HKLM\Software\SynapseAgent\metrics_interval
- Outbound MQTT connections to broker.hivemq.com:8883 from Windows endpoints
- Outbound HTTPS connections to meet.element.tw from Windows endpoints
- HTTP GET requests to ip-api.com/json at process startup
False Positive Assessment
Medium — the backdoor uses legitimate protocols (MQTT, Matrix) and service names that resemble Windows components. However, the specific file names, service names, and registry paths are distinctive enough to enable targeted detection with low false positive rates when combined with behavioral context.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider searching endpoint telemetry for the MD5 hashes BFADBEEE63A4F0BF19EC9DEB8FA58F58 and 7916C33688385525078BEE504C90F359, the filenames cplsupport.exe and wtass.exe, and the service names cplsupport and wtas.
- If found, consider isolating affected hosts and investigating for WinRM-based lateral movement activity in the surrounding timeframe.
- Consider checking for the registry keys HKLM\Software\synapse\Config\SealedConfig and HKLM\Software\SynapseAgent\metrics_interval on endpoints, as their presence indicates the Element backdoor variant has been run.
Infrastructure Hardening
- Evaluate whether WinRM is required on all systems where it is currently enabled; consider restricting it to specific administrative endpoints or disabling it where unused.
- If WinRM must remain enabled, consider enforcing it over HTTPS with certificate-based authentication and restricting access via Windows Firewall to specific admin subnets.
- Consider blocking or alerting on outbound connections to broker.hivemq.com:8883 from Windows endpoints where MQTT is not a business requirement.
- Consider adding meet.element.tw to network blocklists or DNS sinkhole rules if the domain is not used for legitimate business purposes.
User Protection
- Consider deploying endpoint detection rules for the specific service names, file paths, and registry keys associated with both backdoor variants.
- If your EDR supports it, consider creating behavioral detection rules for PowerShell processes spawned by non-standard parent executables with -NonInteractive -NoProfile -Command arguments.
- Evaluate whether your endpoint protection can detect the ChaCha20-Poly1305 configuration sealing behavior tied to MachineGuid registry key access.
Security Awareness
- Consider incorporating awareness of WinRM-based attack techniques into existing security operations training, emphasizing that legitimate administrative tools can be weaponized.
- If applicable to your organization, consider briefing IT staff on the risk of exposed WinRM endpoints and the importance of network-level access controls.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping9 techniques
Tactic
Execution
Tactic
Persistence
Tactic
Defense Impairment
Tactic
Discovery
Tactic
Lateral Movement
Tactic
Command and Control
Additional IOCs
- Urls:
hxxp://ip-api[.]com/json- Legitimate IP geolocation API queried by both backdoor variants at startup to determine the compromised system's public IP address and country. Abused for victim profiling.
- File Hashes:
BFADBEEE63A4F0BF19EC9DEB8FA58F58(MD5) - MD5 hash of cplsupport.exe (HiveMQ backdoor).7916C33688385525078BEE504C90F359(MD5) - MD5 hash of wtass.exe (Element/Matrix backdoor).
- Registry Keys:
HKLM\Software\Microsoft\Cryptography\MachineGuid- Registry key read by both backdoor variants to derive a ChaCha20-Poly1305 encryption key for sealing configuration files. Normal Windows key but its use by non-standard processes is suspicious.
- File Paths:
%PROGRAMDATA%\cplsupport\config.toml- Default configuration file path for the HiveMQ version backdoor. Contains encrypted C2 parameters including agent private key, channel ID, and server public key.%PROGRAMDATA%\SynapseAgent\config.toml- Default configuration file path for the Element version backdoor. Deleted after first run when configuration is migrated to the registry.
- Command Lines:
- Purpose: Execute commands received from C2 server via PowerShell in hidden mode | Tools:
powershell.exe| Stage: Execution |powershell.exe -NonInteractive -NoProfile -Command - Purpose: Install backdoor as a Windows service for persistence | Tools:
cplsupport.exe,wtass.exe| Stage: Persistence |cplsupport.exe --install
- Purpose: Execute commands received from C2 server via PowerShell in hidden mode | Tools:
- Other:
cplsupport- Windows service name used by the HiveMQ version backdoor for persistence. Display name: 'Problem Reports Control Panel Support'.wtas- Windows service name used by the Element version backdoor for persistence. Display name: 'Windows Telemetry Aggregator Service'.!HcJjf78Ste3TSMW72EpeHPms8_6Dcjz7YEsixglUbm4- Matrix room ID used by the Element version backdoor for C2 communication on the attacker-controlled meet.element.tw server.panel-bot- Matrix account name used by the attackers to send commands to the Element version backdoor via the C2 room.
Showing defanged values
- domainmeet[.]element[.]twAttacker-controlled Element/Matrix homeserver used as C2 infrastructure for the matrix-bird-agent backdoor variant. Commands and telemetry are exchanged via Matrix room messages.
- filenamecplsupport.exeHiveMQ version backdoor executable. Dropped to target systems via WinRM and installed as a Windows service. Disguised with a name resembling a Windows control panel support component.
- filenamewtass.exeElement/Matrix version backdoor executable. Dropped to target systems via WinRM and installed as a Windows service. Disguised with a name resembling a Windows telemetry service.
- file_path%PROGRAMDATA%\cplsupport\config.tomlDefault configuration file path for the HiveMQ version backdoor. Contains encrypted C2 parameters including agent private key, channel ID, and server public key.
- file_path%PROGRAMDATA%\SynapseAgent\config.tomlDefault configuration file path for the Element version backdoor. Deleted after first run when configuration is migrated to the registry.
- md57916c33688385525078bee504c90f359MD5 hash of wtass.exe, the Element/Matrix version backdoor binary dropped to disk and installed as a Windows service named 'wtas'.
- md5bfadbeee63a4f0bf19ec9deb8fa58f58MD5 hash of cplsupport.exe, the HiveMQ version backdoor binary dropped to disk and installed as a Windows service named 'cplsupport'.
- registry_keyHKLM\Software\Microsoft\Cryptography\MachineGuidRegistry key read by both backdoor variants to derive a ChaCha20-Poly1305 encryption key for sealing configuration files. Normal Windows key but its use by non-standard processes is suspicious.
- registry_keyHKLM\Software\SynapseAgent\metrics_intervalRegistry key where the Element version backdoor stores the metrics reporting interval, settable remotely via the config:set_interval command.
- registry_keyHKLM\Software\synapse\Config\SealedConfigRegistry key where the Element version backdoor stores its encrypted configuration after first run, replacing the on-disk config.toml file.
- urlhxxp://ip-api[.]com/jsonLegitimate IP geolocation API queried by both backdoor variants at startup to determine the compromised system's public IP address and country. Abused for victim profiling.
- urlhxxps://meet[.]element[.]twFull URL of the attacker-controlled Matrix homeserver used for C2 communication by the matrix-bird-agent backdoor variant.
Stay currentSubscribe via RSS