Angry Birds: Toy Ghouls’ new toys
ID: 62278492-432b-5239-8e3e-b4c05f3e0ca6
STIX ID: report--62278492-432b-5239-8e3e-b4c05f3e0ca6
Feed Name: Securelist by Kaspersky
Date Published: 2026-09-04
Date Updated: 2026-09-05
Author: Kaspersky GERT, Kaspersky Security Services
Toy Ghouls (aka Bearlyfy/Laboo.boo/Feral Wolf) has developed and deployed two custom Windows backdoors — mqtt-bird-agent (uses HiveMQ MQTT broker) and matrix-bird-agent (uses Element/Matrix) — delivered via WinRM and capable of persisting as services, executing remote commands, and exfiltrating telemetry; the report includes configuration/encryption behavior, C2 message formats, persistence and registry artifacts, and multiple IoCs (service names, registry keys, domains and detection verdicts).
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.