New backdoors from Toy Ghouls | Securelist

The Toy Ghouls cybercrime group has escalated its attacks against Russian organizations by deploying custom backdoors that exploit unconventional C2 channels—HiveMQ MQTT and Matrix-based Element messenger—enabling stealthy, persistent control over compromised systems and signaling a marked increase in their operational sophistication.