Angry Birds: Toy Ghouls’ new toys

The Toy Ghouls threat group has significantly evolved its tooling, moving from commodity leaked ransomware builders to custom backdoors that abuse legitimate messaging infrastructure — specifically the HiveMQ MQTT broker and the Element messenger — for command and control communications. This matters because using trusted, widely-adopted protocols and platforms allows malicious C2 traffic to blend seamlessly with normal network activity, making detection extremely difficult with standard signature-based tools. Organizations that lack deep packet inspection, behavioral analytics, or strict egress filtering will likely miss these communications entirely. The group's evolution also signals increasing operational sophistication, meaning defenders must continuously reassess their threat models rather than relying on static indicators of compromise.