BLUERABBIT Backdoor Encrypts Files, Wipes Windows Systems

A new Golang-based backdoor dubbed BLUERABBIT has been observed performing combined data theft, file encryption and destructive disk wiping against Windows hosts.

First seen in mid-to-late March 2026 and suspected to target Israeli entities, BLUERABBIT implements a full-spectrum intrusion framework: remote access, system profiling, exfiltration to attacker-controlled cloud storage, file encryption that appends a .candy extension, and two separate disk‑wiping routines capable of rendering systems unrecoverable.

BLUERABBIT’s architecture is notable for abusing legitimate enterprise-grade components as command-and-control (C2) and data channels.

Rather than relying on conventional HTTP callbacks, the malware leverages RabbitMQ (AMQP) as its primary tasking channel, Redis for state/result management, and MinIO (S3‑compatible) for bulk file exfiltration.

On execution the binary declares an AMQP queue named after the victim device and consumes numeric task IDs encoded as JSON; each ID maps to one of over a dozen built-in modules, enabling modular tasking such as VNC-style remote control, screenshot capture, shell execution, and destructive routines.

Persistence is achieved through a scheduled task masquerading as “OneDrive Update.” The sample checks HKCU\Software\OneDrive\Environment to detect prior runs, and when first executed installs a scheduled task via a PowerShell command that runs at highest available privilege, repeats every 60 seconds, and triggers at startup.

Analysis by the Google Threat Intelligence Group (GTIG) linking the tool to a likely Iran-nexus threat cluster previously responsible for BLUEWIPE and SEWERGOO activity.

Because the authors did not strip symbols from the binary, the internal name “Rabbit” and developmental build markers remained intact, which aided attribution and analysis. Critical configuration items C2 IPs, ports and credentials are AES‑protected within the binary.

Operationally BLUERABBIT follows a clear kill chain: initial execution, persistence, C2 registration via RabbitMQ, tasking, reconnaissance, staging and exfiltration to MinIO, and finally destructive actions.

BLUERABBIT Backdoor Encrypts Files

Reconnaissance collects OS, hardware, network, installed software and security product information, BitLocker status, drivers and domain membership.

Files to exfiltrate are staged in GUID-formatted directories generated with a nonstandard character set (A–Z, 0–9), a reliable detection signal because legitimate Windows GUIDs are hexadecimal only.

The destructive capabilities are severe. BLUERABBIT can encrypt files across all logical drives, adding a .candy extension and replacing the desktop wallpaper with an AI-generated “High-Alert” image, and it includes both single-pass random overwrites and a multi-pass sequence (zeros, random, 0xFF) intended to preclude recovery.

Prior to destruction the malware takes ownership of key boot files with takeown/icacls and modifies registry keys to disable automatic reboot, system recovery and scheduled maintenance, ensuring the wiping or encryption proceeds without interruption.

For defenders, several high‑fidelity detection opportunities exist: the OneDrive Update access scheduled task with immediate repeat triggers; AMQP traffic to unexpected RabbitMQ brokers from endpoints.

MinIO client usage on non-server endpoints or invoked by unusual parent processes; non-hex GUID‑like staging directories; and processes invoking takeown/icacls on boot files outside maintenance windows.

Organizations should urgently validate endpoint and network telemetry for these signals, remove malicious scheduled tasks, block anomalous AMQP and MinIO destinations, and isolate any hosts exhibiting staging or boot-file ownership changes.

Given BLUERABBIT’s combination of exfiltration and irreversible wiping, rapid containment is essential to prevent data loss and long-term operational impact.

Indicators of Compromise

Type	Indicator
File (SHA-256)	633d4cbd496b1094495da89a64f5e6c31a0f6d4d1488411db5b0cba1cfe42001
File (SHA-256)	9706a192e2c1a1faaf0a521daf31c2af60ff4590e3f47bbb4abc227f42af0683
File (SHA-256)	ce9ad5f6c12019f4aae5b189bd8ddf5bb09e75b06a0a587b25a855c65948c913
File (SHA-256)	f622ed85ef31ad4ab973f4e74524866fe1bb44f0965ad2b2ad796cd657a05bfd
IP Address	185.182.193.21
IP Address	212.8.248.104
JA3	806dab5164cf60d94026b88ab2d9851d
JA4	t13i131000_f57a46bbacb6_e5728521abd4
JA3	d80125b9429e9d5f06ace959f00de8d0
JA3S	d75f9129bb5d05492a65ff78e081bcb2
JA4	t13i130900_f57a46bbacb6_e7c285222651

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.