HiveMQ's free tier allows up to 100 concurrent connections and up to 10 GB of traffic a month [14]. Split evenly across that connection ceiling over 30 days, it works out to roughly 100 MB per host per month, near 3.3 MB a day [16]. That sizes the channel as control and telemetry rather than exfiltration, and it matches what the agent actually sends: an online flag, a hostname, a timestamp [15].
The two builds do not create the same network problem. mqtt-bird-agent's destination belongs to HiveMQ [14]. matrix-bird-agent's destination belongs to the attackers, an Element server whose address, room identifier and access token sit in the config, with an interactive password prompt at install time if the token field is empty [12]. Only the first borrows a third party's reputation [17]. The Element build uses a messaging protocol as transport, and once its server address is known it blocks like any other host. How much egress filtering already permits broker.hivemq.com is not something the report measures.
On the host, the config is the engineered part. On first run the backdoor seals sections of config.toml with ChaCha20-Poly1305 under a key derived from HKLM\Software\Microsoft\Cryptography\MachineGuid [8]. In the MQTT build the sealed section holds the agent private key, the channel_id, and the server public key [10]. If decryption fails, the process stops [9]. The Element build deletes the file after its first run and keeps the parameters in HKLM\Software\synapse\Config\SealedConfig [11]. Its fallback config path is %PROGRAMDATA%\SynapseAgent\config.toml, against %PROGRAMDATA%\cplsupport\config.toml for the MQTT build [7].
Both builds request http://ip-api.com/json at startup to learn their public IP and country [13], and the persistence is driven by an install option, with the service switch reserved as the argument the installed service runs under [6]. A new service followed immediately by a geolocation lookup is a detection most SOCs can already write.
The trajectory is the part that generalizes. This group began with tools from public GitHub repositories and leaked Babuk and LockBit builders, moved to its own ransomware in GenieLocker, and only in early July 2026 fielded a versioned agent of its own with a machine-bound config [2][3][19]. The victims Kaspersky names are Russian organizations, and have been since 2025 [1]. For anyone outside that set, the exposure here is the design being copied, not this campaign [20].
