Windows persistence and lateral tooling

Toy Ghouls routes its new backdoor through a free public HiveMQ broker

A crew that started with leaked Babuk and LockBit builders now ships a versioned agent whose command channel sits on a shared MQTT broker and whose config will not decrypt anywhere but the machine it infected.