#ParsedReport #CompletenessLow
04-09-2026

Angry Birds: Toy Ghouls’ new toys

https://securelist.com/toy-ghouls-new-hivemq-and-element-backdoors/121270/

Report completeness: Low

Actors/Campaigns:
Bearlyfy (motivation: financially_motivated)

Threats:
Lockbit
Babuk
Winrm_tool
Evil-winrm_tool
Genielocker
Backdoor.win64.suptoml.gen
Zapchast
Backdoor.win64.agent.smgdvy
Trojan.win64.agent.smgsfo

Victims:
Russian organizations

Geo:
Russian

ChatGPT TTPs:
do not use without manual check
T1012, T1016.001, T1021.006, T1027.013, T1041, T1059.001, T1059.003, T1070.004, T1071, T1082, have more...

IOCs:
File: 7
Domain: 1
Hash: 2

Soft:
Windows service

Algorithms:
chacha20-poly1305, md5

Functions:
seal