Threat Brief — 2026-09-04 — New backdoors and billion-dollar key leaks

Executive summary

Kaspersky's GERT team has uncovered two new backdoor variants from the Toy Ghouls group that abuse legitimate messaging and IoT infrastructure — HiveMQ MQTT brokers and Element/Matrix — for command-and-control, making detection harder for network defenders. Separately, DeFi protocols have lost at least $1.3 billion in the first eight months of 2026, with a notable shift toward private-key compromise as the primary attack vector. 360 NetLab also published a weekly AI-security intelligence report covering late August through early September.

Top items

• Toy Ghouls deploys new backdoors using HiveMQ and Element as C2 infrastructure. Kaspersky GERT researchers identified two backdoor variants from the Toy Ghouls group. One variant uses an HiveMQ MQTT broker as its command server; the other uses the Element Matrix messenger. Both choices leverage legitimate, widely-used protocols and platforms to blend C2 traffic with normal network activity, complicating traffic-based detection. (src: Securelist)

• DeFi losses reach $1.3 billion in 2026, driven by private-key leaks. According to Xakep reporting, DeFi protocols lost at least $1.3 billion across the first eight months of 2026. The report highlights a meaningful shift in attack character: private-key leakage has become the dominant vector for the first time, rather than smart-contract exploits. This suggests attackers are increasingly targeting key-management practices and operational security rather than protocol logic. (src: Xakep)

• 360 NetLab publishes AI-security weekly report (TIC-202609-AI01). The report covers the period 29 August – 4 September 2026 and consolidates 360's threat-intelligence observations on AI-related security topics. Specific findings are primarily in Chinese; the report's existence signals continued industry focus on the intersection of AI and adversarial activity. (src: NetLab 360)

Themes

AI as both weapon and force multiplier. Multiple ongoing stories this week — from BraZetsu's AI-assisted victim valuation to AI-accelerated vulnerability discovery and GitSpawn attacks against AI coding agents — underscore that AI is reshaping both offensive and defensive operations. The new 360 NetLab weekly AI-security report reflects the industry's formalisation of this as a dedicated intelligence discipline.

Abuse of legitimate infrastructure for C2. Toy Ghouls' use of HiveMQ and Element mirrors a broader pattern of threat actors co-opting trusted platforms (messaging, IoT brokers, CDN services) to evade network monitoring. This trend demands detection strategies that go beyond IP and domain reputation.

Cryptocurrency crime pivot to key theft. The $1.3B DeFi loss data point, alongside the ongoing Coldcard wallet heist laundering via THORChain, signals a shift from protocol-level exploits to operational key compromise — placing greater emphasis on key custody and access controls.