Loading story…
Binary Defense disclosed a newly identified Go-based Windows backdoor, BLUERABBIT, that provides attackers with persistent access, reconnaissance, screenshot and screen-recording capture, shell execution, and data theft before escalating to file encryption and destructive wiping. The malware is assessed as likely tied to an Iran-nexus activity cluster and appears primarily aimed at organizations in Israel. Researchers said BLUERABBIT was first observed in mid-to-late March 2026 and linked it to activity associated with BLUEWIPE and SEWERGOO.
BLUERABBIT blends into enterprise environments by using RabbitMQ over AMQP for command-and-control, Redis for task state management, and MinIO for S3-compatible exfiltration. It persists through a scheduled task named "OneDrive Update", stores staging data under HKCU\Software\OneDrive, can encrypt files with the .candy extension, and includes two wiping routines that disable Windows recovery mechanisms and alter boot-file permissions to make systems unrecoverable. Detection opportunities include anomalous AMQP traffic from workstations, suspicious MinIO client execution, unusual GUID-like staging folders, the fake OneDrive task, and unauthorized use of tools such as takeown or icacls against critical boot files.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Binary Defense published a report detailing BLUERABBIT's use of RabbitMQ, Redis, and MinIO, along with its persistence, encryption, and disk-wiping capabilities. The report also released detection opportunities, file hashes, IP addresses, and TLS fingerprints as indicators of compromise.
Binary Defense said the BLUERABBIT Golang backdoor and destructive intrusion tool was first observed in mid-to-late March 2026. The activity was assessed as primarily targeting entities in Israel.
Binary Defense reported that Google Threat Intelligence Group had previously linked the BLUEWIPE and SEWERGOO activity from June 2025 to a likely Iran-nexus activity cluster later associated with BLUERABBIT.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcebinarydefense.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed a destructive Go-based Windows backdoor dubbed **GigaWiper** that has been observed in compromised environments since October 2025, combining espionage, remote access, and sabotage functions in a single modular implant. The malware supports about 20 command codes and can wipe physical disks, overwrite the Windows drive, trigger BSOD-based disruption, clear event logs, manipulate processes, services, and the registry, capture screenshots, record screens, and provide hidden VNC-like remote control. It also masquerades as OneDrive and uses **RabbitMQ**, **Redis**, and in some reporting **MinIO** for command, result handling, and data exfiltration. Microsoft said GigaWiper appears to be assembled from at least three malware families, with code overlaps linking it to **Crucio** and **FlockWiper** and references to a broader framework labeled **GRAT**. One destructive component mimics ransomware by encrypting files without preserving a recovery key, making restoration impossible except from clean backups, while another performs multi-pass secure wiping. Separate reporting said the same hashes and command-and-control infrastructure matched Binary Defense's earlier **BLUERABBIT** findings, and cited broader research associating related tooling with likely Iran-linked operations targeting Israeli organizations, though Microsoft did not publicly attribute the activity to a country.
Jul 17, 2026
Researchers detailed **BlueSky**, an emerging Windows ransomware family that rapidly encrypts files through a multithreaded design and uses anti-analysis features plus a staged PowerShell infection chain. The malware was observed being delivered from `kmsauto[.]us` via `start.ps1` and `stage.ps1`, then saved locally as `javaw.exe`. It attempts privilege escalation with **JuicyPotato** on older Windows systems and uses exploits for `CVE-2020-0796` and `CVE-2021-1732` on newer hosts before encrypting files, appending the `.bluesky` extension, and dropping ransom notes named `# DECRYPT FILES BLUESKY #.txt` and `# DECRYPT FILES BLUESKY #.html`. Technical analysis found BlueSky shares strong code similarities with **Conti v3**, particularly in its multithreaded architecture and network share enumeration, while its cryptography aligns more closely with **Babuk** through the use of **ChaCha20** for file encryption and **Curve25519** for key generation. The ransomware excludes selected extensions and directories, creates host-specific identifiers, and stores encryption-state artifacts including a mutex and `HKCU\Software\<32-byte ID>` registry entries. Investigators also found **RedLine**-related samples hosted on the same domain, indicating possible infrastructure overlap or operational ties even though no direct code overlap was identified.
Aug 14, 2026
BlackCat/ALPHV operators were linked to intrusions that began with exploitation of vulnerable **Microsoft Exchange** servers, including **`CVE-2021-31207`** in ProxyShell-style activity and other unpatched Exchange exposures. Investigators observed the attackers planting **ASPX web shells**, using IIS worker processes to launch PowerShell, and establishing persistence and remote access with tools including **MobaXterm**. In one case, a tampered **`libeay32.dll`** was downloaded to sideload **Cobalt Strike**, while post-compromise activity included credential theft through **Mimikatz** or **LSASS** dumping with Process Hacker, along with account and network discovery using **SoftPerfect Network Scanner**, **NetScan**, **BloodHound**, **Inveigh**, and **CrackMapExec**. Before encryption, the operators compressed targeted data with **WinRAR** or **7-Zip** and exfiltrated files through **rclone**, **MEGAsync**, and in some cases **FileZilla** or **WinSCP**. Lateral movement and staging were carried out over SMB, including use of **SysVol** shares and local paths such as **`C:\Windows\debug`**, followed by permission changes, shadow copy deletion, recovery disabling, and log clearing. Researchers also identified a newer BlackCat variant with previously undocumented command-line options including **`--safeboot`** and **`--sleep-restart`**, underscoring the group’s continued ability to target **Windows, Linux, and VMware ESXi** environments while pairing encryption with data theft and Tor-based extortion.
Aug 15, 2026