Investigating attacks by a particular hacker group year by year, one can observe how this threat is evolving. One of the signs of its growth is the transition from third-party malicious tools to its own soft.
The Labooboo group (Toy Ghouls, Bearlyfy), which has been attacking Russian organizations since 2025, initially used third-party ransomware RedAlert, LockBit, and Babuk, but in March 2026 they switched to their own ransomware GenieLocker.
And recently, our experts discovered that this group has added its own backdoor to its arsenal. The backdoor exists in at least two variations, using MQTT and Matrix protocols for C2 communication.
The MQTT implementation (MD5: BFADBEEE63A4F0BF19EC9DEB8FA58F58) specifies broker.hivemq.com:8883 as the broker. Message exchange is performed through the _id_/cmd/req, _id_/cmd/res, _id_/metrics3, and _id_/status topics to receive commands, send execution results, metrics, and backdoor status, respectively.
The Matrix implementation (MD5: 7916C33688385525078BEE504C90F359) connects the malware to a specific room on the public server meet.element.tw and executes commands from messages starting with cmd. Execution results, metrics, and status are published as messages in the room.
The identified samples have been added to our antivirus databases. We continue to monitor Labooboo. Detailed analysis of the discovered backdoors will be published later.
