mqtt-bird-agent C2 to HiveMQ Broker (broker.hivemq.com:8883)

Arnold Chan@slaz

•updated Sep 4, 2026•0•0•3

Detects outbound network traffic from internal hosts to the HiveMQ public broker using the MQTT protocol over TLS, a behavior associated with the Toy Ghouls mqtt-bird-agent C2 infrastructure.