The financially motivated threat actor Toy Ghouls has evolved its operational capabilities by deploying custom backdoors named mqtt-bird-agent and matrix-bird-agent. These backdoors leverage unconventional command and control channels via HiveMQ MQTT broker and Element messenger, respectively. Infection vectors include Windows Remote Management (WinRM) exploitation using tools like Evil-WinRM and WinRM-fs. The malware maintains persistence as Windows services and secures its configuration files using the ChaCha20-Poly1305 encryption algorithm. Execution of attacker commands occurs via PowerShell or command line interfaces. The backdoors also gather system performance metrics to inform attacker operations. This development represents a notable advancement from the group's prior reliance on public GitHub tools and leaked ransomware builders to a more sophisticated, custom malware infrastructure.

The deployment of custom backdoors by Toy Ghouls enables persistent unauthorized access to targeted Windows systems, allowing attackers to execute arbitrary commands and maintain stealthy control. The use of encrypted configuration files and unconventional communication channels complicates detection and analysis. Collection of system metrics may facilitate tailored attacks or further compromise. Although no active exploits in the wild are reported, the presence of these backdoors poses a medium risk to affected organizations, particularly those targeted by this group.

No official patches or fixes are available for this malware as it is custom-developed by the threat actor. Mitigation should focus on securing Windows Remote Management (WinRM) access by enforcing strong authentication, limiting access to trusted hosts, and monitoring for unusual WinRM activity. Network defenders should also monitor for indicators of compromise such as the provided hashes and domain 'meet.element.tw'. Employing endpoint detection and response solutions capable of identifying persistence as Windows services and unusual PowerShell or command line activity is recommended. Since this is a targeted threat, organizations should apply threat intelligence updates and harden systems accordingly.