Executive Summary

Kaspersky GERT researchers uncovered two new backdoor variants deployed by the Toy Ghouls threat group. One variant uses the HiveMQ MQTT broker as its command‑and‑control (C2) server, while the other leverages the Matrix-based Element messenger for C2 communications.

---

Intelligence Metadata - Source Publisher: Securelist - Published Date: 2026-09-04T10:00:05+00:00 - Category: malware

Original Description: Kaspersky GERT experts have discovered new backdoors used by the Toy Ghouls group. One version of the backdoor uses the HiveMQ MQTT broker as its command-and-control server; the other uses the Matrix-based Element messenger.

"A thing long expected takes the form of the unexpected when at last it comes."

— Mark Twain