Full Report
Kaspersky GERT experts have discovered new backdoors used by the Toy Ghouls group. One version of the backdoor uses the HiveMQ MQTT broker as its command-and-control server; the other uses the Matrix-based Element messenger.
Analysis Summary
# Threat Actor: Toy Ghouls
## Attribution & Identity
* **Name/Alias:** Toy Ghouls
* **Identification:** A recently identified threat actor group tracked by Kaspersky’s Global Emergency Response Team (GERT).
* **Known Associations:** No explicit links to known state-sponsored actors were detailed in the summary, but the sophistication of their custom backdoors suggests a disciplined operational structure.
## Activity Summary
The group is currently active, deploying new and sophisticated custom backdoors designed to maintain persistence and exfiltrate data. Their latest campaign is notable for using non-traditional Command-and-Control (C2) channels—specifically commercial IoT brokers and decentralized messaging platforms—to blend in with legitimate network traffic.
## Tactics, Techniques & Procedures
* **C2 via MQTT:** Uses the HiveMQ MQTT broker for command and control. This allows the malware to communicate using a protocol typically associated with IoT devices, bypassing traditional firewall rules.
* **C2 via Decentralized Messaging:** Uses the Matrix-based **Element** messenger for C2 communication, leveraging the platform’s encryption and legitimate infrastructure to hide malicious traffic.
* **Persistence:** Deployment of custom-developed backdoors.
* **Evasion:** Using legitimate cloud services and communication protocols (MQTT, Matrix) to avoid detection by signature-based security tools.
**MITRE ATT&CK IDs:**
* **T1102.002:** Communication through Public Services (Element/Matrix)
* **T1071.001:** Web Service: Application Layer Protocol
* **T1437.001:** Command and Control: Message Service (MQTT)
## Targeting
* **Sectors:** Specific sectors are not named in the provided snippet, but the use of HiveMQ suggests potential interest in organizations utilizing IoT infrastructure or industrial environments.
* **Geography:** Global distribution (specific regions not disclosed).
* **Victims:** Specific organizations were not listed in the summary.
## Tools & Infrastructure
* **Malware Families:**
* **Toy Ghouls Backdoor (MQTT Version):** Specifically built to interact with HiveMQ brokers.
* **Toy Ghouls Backdoor (Element Version):** Designed to receive commands and send data via the Element messenger.
* **Infrastructure:**
* **HiveMQ:** `broker.hivemq[.]com` (Used for MQTT C2)
* **Element/Matrix:** `matrix[.]org` or private Matrix homeservers used for communication.
* **Defanged URLs/IPs:** `hxxps[://]element[.]io`, `hxxps[://]www[.]hivemq[.]com`.
## Implications
The Toy Ghouls group represents a shift toward "Living off the Messaging/IoT Services" (LOM/LOI). By using HiveMQ and Element, they significantly increase the difficulty of detection for SOC teams, as these services are often white-listed or generate high volumes of legitimate traffic. This suggests a focus on long-term espionage and stealthy data exfiltration.
## Mitigations
* **Network Monitoring:** Monitor and baseline MQTT traffic (Port 1883/8883) and Matrix protocol traffic. Unusual spikes or connections to public brokers from non-IoT assets should be investigated.
* **Protocol Analysis:** Implement Deep Packet Inspection (DPI) to identify malicious payloads within legitimate MQTT or HTTPS streams.
* **Endpoint Detection:** Deploy EDR solutions to monitor for unauthorized processes attempting to bind to network sockets or accessing configuration files related to Element/Matrix.
* **Application Control:** Restrict the installation and execution of messaging applications like Element on critical servers or workstations unless strictly required for business.