CTI · corroborated · 2026-09-05

Hackers Turn HiveMQ and Element Messenger Into Control Channels for Windows Backdoors

Full story & timeline

Actors

Toy GhoulsBearlyfyLaboo.booFeral Wolf

Malware / tools

GenieLockermqtt-bird-agentmatrix-bird-agent

Campaigns

Toy Ghouls custom malware campaign

CVEs

—

Victim sectors

organizations

Geography

Russia

MITRE ATT&CK

T1021 Remote Services Lateral Movement
T1572 Protocol Tunneling Command and Control
T1102 Web Service Command and Control
T1547 Boot or Logon Autostart Execution Persistence

Indicators

Observables tied to this case, from the curated feed. raw sidecar

laboo.boo domain · expired

Detections

No detection content yet — case analysis did not yield signal-specific telemetry. Check back after the next daily CTI pass.

References

Source on GitHub