#chacha20 — Public Fediverse posts

Angry Birds: Toy Ghouls’ new toys

Toy Ghouls, a financially motivated group targeting Russian organizations since 2025, has deployed custom backdoors for the first time. Two versions were identified: mqtt-bird-agent using HiveMQ MQTT broker and matrix-bird-agent using Element messenger as command and control infrastructure. The backdoors are delivered via Windows Remote Management (WinRM) using tools like Evil-WinRM and WinRM-fs. They establish persistence as Windows services, encrypt configuration files using ChaCha20-Poly1305 algorithm, and execute commands via PowerShell or command line. The backdoors collect system metrics including CPU load, memory, and disk usage, and communicate with attackers through unconventional channels. This represents a significant evolution from their previous reliance on public GitHub tools and leaked ransomware builders to custom-developed malware.

Pulse ID: 6a9abac288231f0634632e30
Pulse Link: https://otx.alienvault.com/pulse/6a9abac288231f0634632e30
Pulse Author: AlienVault
Created: 2026-09-04 12:34:10

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BackDoor #ChaCha20 #CyberSecurity #GitHub #ICS #InfoSec #MQTT #Malware #OTX #OpenThreatExchange #PowerShell #RAT #RansomWare #Russia #Windows #bot #AlienVault

Angry Birds: Toy Ghouls’ new toys

Toy Ghouls, a financially motivated group targeting Russian organizations since 2025, has deployed custom backdoors for the first time. Two versions were identified: mqtt-bird-agent using HiveMQ MQTT broker and matrix-bird-agent using Element messenger as command and control infrastructure. The backdoors are delivered via Windows Remote Management (WinRM) using tools like Evil-WinRM and WinRM-fs. They establish persistence as Windows services, encrypt configuration files using ChaCha20-Poly1305 algorithm, and execute commands via PowerShell or command line. The backdoors collect system metrics including CPU load, memory, and disk usage, and communicate with attackers through unconventional channels. This represents a significant evolution from their previous reliance on public GitHub tools and leaked ransomware builders to custom-developed malware.

Pulse ID: 6a9abac288231f0634632e30
Pulse Link: https://otx.alienvault.com/pulse/6a9abac288231f0634632e30
Pulse Author: AlienVault
Created: 2026-09-04 12:34:10

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BackDoor #ChaCha20 #CyberSecurity #GitHub #ICS #InfoSec #MQTT #Malware #OTX #OpenThreatExchange #PowerShell #RAT #RansomWare #Russia #Windows #bot #AlienVault

Angry Birds: Toy Ghouls’ new toys

Toy Ghouls, a financially motivated group targeting Russian organizations since 2025, has deployed custom backdoors for the first time. Two versions were identified: mqtt-bird-agent using HiveMQ MQTT broker and matrix-bird-agent using Element messenger as command and control infrastructure. The backdoors are delivered via Windows Remote Management (WinRM) using tools like Evil-WinRM and WinRM-fs. They establish persistence as Windows services, encrypt configuration files using ChaCha20-Poly1305 algorithm, and execute commands via PowerShell or command line. The backdoors collect system metrics including CPU load, memory, and disk usage, and communicate with attackers through unconventional channels. This represents a significant evolution from their previous reliance on public GitHub tools and leaked ransomware builders to custom-developed malware.

Pulse ID: 6a9abac288231f0634632e30
Pulse Link: https://otx.alienvault.com/pulse/6a9abac288231f0634632e30
Pulse Author: AlienVault
Created: 2026-09-04 12:34:10

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BackDoor #ChaCha20 #CyberSecurity #GitHub #ICS #InfoSec #MQTT #Malware #OTX #OpenThreatExchange #PowerShell #RAT #RansomWare #Russia #Windows #bot #AlienVault

Angry Birds: Toy Ghouls’ new toys

Toy Ghouls, a financially motivated group targeting Russian organizations since 2025, has deployed custom backdoors for the first time. Two versions were identified: mqtt-bird-agent using HiveMQ MQTT broker and matrix-bird-agent using Element messenger as command and control infrastructure. The backdoors are delivered via Windows Remote Management (WinRM) using tools like Evil-WinRM and WinRM-fs. They establish persistence as Windows services, encrypt configuration files using ChaCha20-Poly1305 algorithm, and execute commands via PowerShell or command line. The backdoors collect system metrics including CPU load, memory, and disk usage, and communicate with attackers through unconventional channels. This represents a significant evolution from their previous reliance on public GitHub tools and leaked ransomware builders to custom-developed malware.

Pulse ID: 6a9abac288231f0634632e30
Pulse Link: https://otx.alienvault.com/pulse/6a9abac288231f0634632e30
Pulse Author: AlienVault
Created: 2026-09-04 12:34:10

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BackDoor #ChaCha20 #CyberSecurity #GitHub #ICS #InfoSec #MQTT #Malware #OTX #OpenThreatExchange #PowerShell #RAT #RansomWare #Russia #Windows #bot #AlienVault

Angry Birds: Toy Ghouls’ new toys

Toy Ghouls, a financially motivated group targeting Russian organizations since 2025, has deployed custom backdoors for the first time. Two versions were identified: mqtt-bird-agent using HiveMQ MQTT broker and matrix-bird-agent using Element messenger as command and control infrastructure. The backdoors are delivered via Windows Remote Management (WinRM) using tools like Evil-WinRM and WinRM-fs. They establish persistence as Windows services, encrypt configuration files using ChaCha20-Poly1305 algorithm, and execute commands via PowerShell or command line. The backdoors collect system metrics including CPU load, memory, and disk usage, and communicate with attackers through unconventional channels. This represents a significant evolution from their previous reliance on public GitHub tools and leaked ransomware builders to custom-developed malware.

Pulse ID: 6a9abac288231f0634632e30
Pulse Link: https://otx.alienvault.com/pulse/6a9abac288231f0634632e30
Pulse Author: AlienVault
Created: 2026-09-04 12:34:10

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BackDoor #ChaCha20 #CyberSecurity #GitHub #ICS #InfoSec #MQTT #Malware #OTX #OpenThreatExchange #PowerShell #RAT #RansomWare #Russia #Windows #bot #AlienVault