Toy Ghouls Shows Why Custom C2 Needs Protocol-Aware Monitoring, Bulwark Black

Toy Ghouls Shows Why Custom C2 Needs Protocol-Aware Monitoring

Kaspersky reports that Toy Ghouls has added custom Windows backdoors using HiveMQ MQTT and Matrix/Element-style command channels. For SMBs and government contractors, the lesson is not just malware blocking — it is protocol-aware egress control, service persistence review, and post-compromise valida

Kaspersky Securelist reported a useful shift in the Toy Ghouls playbook: the financially motivated group is no longer relying only on public tools and leaked ransomware builders. Researchers observed custom Windows backdoors that communicate through unusual but legitimate-looking channels, including HiveMQ MQTT infrastructure and a Matrix/Element-style messaging server.

That matters because defenders often tune heavily for known malware families, commodity remote management tools, and obvious ransomware staging. Toy Ghouls’ newer approach pushes the problem into a harder area: legitimate protocols, encrypted configuration, Windows service persistence, and command traffic that can blend into normal outbound application activity.

What Kaspersky reported

The Securelist analysis describes two related backdoor variants: one using HiveMQ MQTT broker communications and another using a Matrix/Element-based command channel. Kaspersky says the group delivered the tools to compromised systems over Windows Remote Management using open-source utilities, then configured them to run interactively or persist as Windows services.

The backdoors collect basic host telemetry, maintain configuration material locally, and retrieve attacker commands for execution. The HiveMQ variant uses MQTT-style request and response paths, while the Element variant stores configuration in the Windows registry after first run and receives commands through attacker-controlled messaging infrastructure.

Original source: Kaspersky Securelist — “Angry Birds: Toy Ghouls’ new toys”.

Why this is bigger than one malware family

Many small and mid-sized environments still treat outbound traffic as trusted by default. That is dangerous when attackers can use common protocols and third-party services as command channels. MQTT, chat platforms, developer services, cloud storage, remote monitoring tools, and collaboration APIs can all become control paths if security teams only block obviously malicious domains.

The defensive question is not “Do we use HiveMQ or Matrix?” It is “Would we notice an endpoint suddenly behaving like a service bot, sending periodic host metrics, reaching unfamiliar broker infrastructure, or spawning hidden PowerShell from a newly installed Windows service?”

Defensive takeaways for SMBs and government contractors

Baseline outbound protocols. Know which systems should use MQTT, Matrix/Element, unusual HTTPS APIs, or broker-style connections. Everything else should be questioned.
Control egress by role. Workstations and servers should not have broad outbound access just because traffic is encrypted or uses TCP/443-style paths.
Audit Windows service creation. Alert on new services, suspicious display names, unexpected binary paths under ProgramData, and service-launched shells.
Watch WinRM carefully. If WinRM is enabled, log and restrict it. Remote administration should be tied to known admin hosts, MFA-backed accounts, and change windows.
Correlate process and network telemetry. A broker connection is more suspicious when the parent process is a new service binary or when command execution follows shortly after.
Preserve logs off-host. If a host is compromised, local evidence can be modified or deleted. Centralized logging gives responders something to trust.

Bulwark Black assessment

Toy Ghouls’ move into custom backdoors is a reminder that ransomware crews and financially motivated actors mature quickly when their operations keep working. Once a group graduates from borrowed tooling into custom persistence and C2, defenders need to move beyond static indicators and start hunting behaviors: remote management abuse, service installation, registry-backed configuration, periodic telemetry, and command execution through approved-looking protocols.

For organizations supporting government contracts, this is especially relevant. CMMC-style security programs often focus on access control, audit logging, configuration management, and incident response. This campaign touches all four. The practical win is to turn those compliance controls into real detection logic: restrict administration paths, monitor service creation, review unusual outbound destinations, and prove that critical logs survive endpoint compromise.