Angry Birds: Toy Ghouls’ new toys

Kaspersky SecurelistSeptember 4, 2026Threat Intel

Kaspersky GERT experts have discovered new backdoors used by the Toy Ghouls group. One version of the backdoor uses the HiveMQ MQTT broker as its command-and-control server; the other uses the Matrix-based Element messenger.

Summary from Kaspersky Securelist.

Read the full article at Kaspersky Securelist

Explained

The technology and terms in this story. Learn more

AttackBackdoorA hidden way back into a system that bypasses normal logins.
ConceptCommand and control · C2The servers attackers use to send instructions to their malware and receive stolen data.

Angry Birds: Toy Ghouls’ new toys

Explained

More in Threat Intel

Synthetic identities leave US lenders with $2.4 billion in fraud exposure

Sponsored: Should your threat hunt become a detection?

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 120

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet