MalwareTips News Toy Ghouls deploys custom Windows backdoor against Russian organizations

[News Now]

Kaspersky says the financially motivated Toy Ghouls group has begun using a custom Windows backdoor in attacks on Russian organizations. A backdoor is malware that gives attackers remote access; in this case, it can collect system details, run commands and return the results.

Good to know

The report describes targeted attacks, not a widespread infection affecting all Windows users.

A move toward custom attack tools​

According to Kaspersky researchers, Toy Ghouls has targeted Russian organizations since 2025. The group previously used public tools and leaked ransomware builders before moving to its own ransomware and, in July 2026, its first observed custom backdoor.

Kaspersky assesses that this move toward purpose-built tools may help the group make attacks more sophisticated and remain undetected for longer. That is an assessment rather than proof of the attackers’ intent.

What the backdoor can do​

After attackers have compromised a system, they deliver the backdoor through Windows Remote Management, a legitimate feature administrators use to manage Windows computers remotely. The malware can then install itself as a Windows service so it starts persistently.

• Reports the computer’s public IP address, location and online status.
• Sends operating details including CPU load, memory, disk use, uptime and hostname.
• Receives commands, runs them through PowerShell or the Windows command line, and sends the output back.

Legitimate services used for control traffic​

Kaspersky identified two versions. One communicates through the public HiveMQ messaging broker, while the other uses an attacker-operated Element server based on the Matrix messaging system.

Use of a legitimate public service does not mean that service or its users are compromised. Defenders should instead investigate unexpected connections alongside unusual services, command execution and other signs listed in Kaspersky’s report.

Important

Organizations that find the named files, service names or configuration locations should treat them as investigation leads, not conclusive proof on their own.

Practical checks for defenders​

• Review remote-management activity for unexpected file transfers to Windows systems, particularly where administrative access was not planned.
• Look for unfamiliar Windows services associated with the filenames and service names in the vendor’s indicators.
• Correlate unexpected messaging-service traffic with hidden PowerShell or command-line activity before deciding whether a host is infected.

Does your organization restrict Windows Remote Management to specific administrator accounts and network segments, or leave it available more broadly?