matrix-bird-agent C2 traffic to meet.element[.]tw Matrix homeserver

Arnold Chan@slaz

•updated Sep 4, 2026•0•0•1

Detects network activity related to the Toy Ghouls 'matrix-bird-agent' backdoor. The rule identifies communication with the domain 'meet.element.tw' via TLS SNI and HTTP host headers, as well as specific Matrix API event types (m.bird.status, m.bird.metrics, m.bird.cmd_response) and references to 'panel-bot' within the HTTP request body, indicating potential command-and-control behavior.