Toy Ghouls' New HiveMQ and Element Backdoors

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://securelist.com/toy-ghouls-new-hivemq-and-element-backdoors/121270
• Blog Title: Toy Ghouls' New HiveMQ and Element Backdoors
• Suggested Section: Basic Forensic Methodology > Malware Analysis / Windows post-exploitation, with cross-references from Network Services Pentesting > MQTT and Windows lateral movement > WinRM

🎯 Content Summary

Overview

Toy Ghouls, also tracked as Bearlyfy, Laboo.boo, and Feral Wolf, is a financially motivated threat group targeting Russian organizations since 2025. The group initially used tools from public GitHub repositories and leaked Babuk and LockBit ransomware builders, later developed the custom GenieLocker ransomware, and in early July 2026 deployed its first observed custom backdoor.

Kaspersky identified two ...

🔧 Technical Details

WinRM-based implant delivery: After obtaining access to a Windows host, an attacker can use WinRM and tools such as Evil-WinRM or WinRM-fs to transfer an executable and configuration remotely. Detection should correlate unusual WinRM logons or file operations with executable creation, configuration deployment, and subsequent service registration.

Service-based backdoor persistence: A Windows implant can provide an operator-facing installation command that registers the executable as a service, while a hidden or internal service-mode argument is configured for use by the Service Control Manager. The implant then runs continuously and executes received commands under the service account's security context. Hunt for newly created services with misleading display names, unusual binary paths, internal service arguments, and immediate external network communication.

Machine-bound configuration encryption: Malware can protect C...

🤖 Agent Actions

Plan:

1. Inspect the repository structure and at least five relevant MQTT, WinRM, persistence, malware-analysis, and C2 pages.
2. Compare the blog’s techniques with existing coverage and select one best existing page.
3. Add only novel, abstracted technical material with numbered citations and the required reference section.
4. Review the diff, validate links/formatting, and confirm no forbidden-source material was introduced.
   I found existing pages for all adjacent topics, so I’ll now compare their scope and citation conventions before choosing a single edit target; this avoids duplicating the same technique across MQTT, WinRM, and forensic pages.
   The comparison shows the MQTT and WinRM pages already document their offensive use and tooling. The genuinely new material is forensic analysis of machine-bound sealed configs plus MQTT/Matrix C2 correlation, so I’m adding it once to the existing malware-analysis page and linking to the established protocol pages rather than duplicating their content.
   The edit is now in place. I’m doing a final structural validation: checking Markdown/build behavior, reference numbering, internal link resolution, and ensuring only the intended file changed.
   Updated src/generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.md.

Added:

• Machine-bound ChaCha20-Poly1305 configuration analysis.
• MachineGuid-based decryption and recovery workflow.
• Registry, service, and configuration collection commands.
• MQTT/Matrix C2 forensic correlation techniques.
• WinRM, service creation, PowerShell, geolocation, and messaging telemetry pivots.
• Internal links to existing MQTT and WinRM pages.
• Numbered Securelist reference and citations.

Validation passed for Markdown diff, internal links, citation numbering, and forbidden-source checks. mdbook was unavailable, so the full build was not run.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://securelist.com/toy-ghouls-new-hivemq-and-element-backdoors/121270

Content Categories: Based on the analysis, this content was categorized under "Basic Forensic Methodology > Malware Analysis / Windows post-exploitation, with cross-references from Network Services Pentesting > MQTT and Windows lateral movement > WinRM".

Repository Maintenance:

• MD Files Formatting: 1029 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0