BLUERABBIT Backdoor Targets Windows Systems With Encryption and Disk Wiping
Malware Intelligence · 2 sources · Updated 4mo ago · First seen Jun 11, 2026
Binary Defense disclosed a newly identified Go-based Windows backdoor, BLUERABBIT, that provides attackers with persistent access, reconnaissance, screenshot and screen-recording capture, shell execution, and data theft before escalating to file encryption and destructive wiping. The malware is assessed as likely tied to an Iran-nexus activity cluster and appears primarily aimed at organizations in Israel. Researchers said BLUERABBIT was first observed in mid-to-late March 2026 and linked it to activity associated with BLUEWIPE and SEWERGOO.
BLUERABBIT blends into enterprise environments by using RabbitMQ over AMQP for command-and-control, Redis for task state management, and MinIO for S3-compatible exfiltration. It persists through a scheduled task named "OneDrive Update", stores staging data under HKCU\Software\OneDrive, can encrypt files with the .candy extension, and includes two wiping routines that disable Windows recovery mechanisms and alter boot-file permissions to make systems unrecoverable. Detection opportunities include anomalous AMQP traffic from workstations, suspicious MinIO client execution, unusual GUID-like staging folders, the fake OneDrive task, and unauthorized use of tools such as takeown or icacls against critical boot files.
