securelist.com· Sep 4, 2026· by Kaspersky GERT, Kaspersky Security Services

Angry Birds: Toy Ghouls’ new toys

Kaspersky GERT experts have discovered new backdoors used by the Toy Ghouls group. One version of the backdoor uses the HiveMQ MQTT broker as its command-and-control server; the other uses the Matrix-based Element messenger.

🎯 Vulnerability: Web Security Vulnerability

💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.

#SOC, TI and IR posts#Malware descriptions#Malware Technologies#Microsoft Windows#Targeted attacks#Malware Descriptions#Malware#Backdoor

Angry Birds: Toy Ghouls’ new toys

More Writeups Like This

MacSync under the microscope: new delivery methods and a new payload

ValleyRAT masquerading as adware

Toy Ghouls’ new toy: the GenieLocker ransomware

New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery